Windows Restore is a fake software that belongs to rogue virus family. This malware is a useless tool which claims to be a legitimate system security software. Windows Restore offers several security services including spyware and virus removal options although this program is totally useless and it is not able to detect or remove any virus from your computer. Simply, Windows Restore is just cloned and given an interface to appear like a real antivirus scan to trick more and more users into buying this fake antivirus software.
Windows Restore is a scam-ware tool which is designed by hackers to make money by selling fake security softwares to innocent internet users. These badware programmers code these malwares and then spread these malwares using trojans and worms from malicious websites. When Windows Restore virus gets into your computer, you,ll notice unwanted popups on your screen. These popups will warn you of spyware and virus infections. It may display different warning messages and alerts like Windows Restore has detected some viruses on your computer or your computer is infected with spywares that must be removed very soon to protect your system from further damages. It will also offer you to use Windows Restore software to get rid of these viruses. If you click the install or run Windows Restore link inside those popups, you,ll be redirected to a page that will ask you to pay the license fee for the full version of Windows Restore to get rid of viruses and spywares from your computer.
Pleaser Remember! All these warnings, alerts and virus removal offers made by Windows Restore virus are fake. This program is totally a fake software and it is specially designed to extort your money by selling its fake security products. You should ignore these warnings, avoid purchase of this program, avoid clicking any link within its popups and do not install any component of it promoted. All you have to do is to immediately remove it from your computer upon detection.
How to remove Windows Restore virus manually:
To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Windows Restore processes:
[random].exe
Remove Windows Restore Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policie \Associations “LowRiskFileTypes” = ‘{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
Remove Windows Restore files:
%AppData%\Microsoft\[random].exe
%UserProfile%\Desktop\Windows Restore.lnk
%UserProfile%\Start Menu\Programs\Windows Restore\
%UserProfile%\Start Menu\Programs\Windows Restore\Windows Restore.lnk
%UserProfile%\Start Menu\Programs\Windows Restore\Uninstall Windows restore.lnk
Source: http://www.techvts.com/fake-windows-restore-removal
