Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: "Windows Vista Recovery" malware removal

17 May 2011   #1
Victek

Windows 7 x64
 
 
"Windows Vista Recovery" malware removal

A customer picked up the Windows Vista Recovery virus and I could use some help with the removal procedure. I'm currently scanning with a newly created Norton Internet Security bootable CD. The scan takes a while and I don't know yet if it will fully detect and remove the problem. In case you're not familiar with it the virus blocks access to anti-malware apps, hides user data files and is active in SAFE mode. I can't find a way to get to the usual load points, such as "appdata" etc, to see find the virus EXE. I have booted with a rescue CD, but access to folders in the user profile is denied. Is there a removal FAQ for this one? TIA.


My System SpecsSystem Spec
.
17 May 2011   #2
Jacee
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

See if the manual removal instructions here, will help Windows Vista Recovery and Windows 7 Recovery - Virus Solution and Removal
My System SpecsSystem Spec
19 May 2011   #3
Victek

Windows 7 x64
 
 

Quote   Quote: Originally Posted by Jacee View Post
See if the manual removal instructions here, will help Windows Vista Recovery and Windows 7 Recovery - Virus Solution and Removal
Thanks for the reply. As it worked out the Norton Internet Security boot CD was able to find and remove the active malware (which included the TDSS rootkit). Afterward I had control of the desktop and was able to remove the remaining malware traces and undue the registry hacks in stages. In particular I found a tool called "Unhide.exe" which made the user data visible again. This was an interesting mess to unwind.
My System SpecsSystem Spec
.

07 Jun 2011   #4
James Colbert

 
 

Quote   Quote: Originally Posted by Victek View Post
Quote   Quote: Originally Posted by Jacee View Post
See if the manual removal instructions here, will help Windows Vista Recovery and Windows 7 Recovery - Virus Solution and Removal
Thanks for the reply. As it worked out the Norton Internet Security boot CD was able to find and remove the active malware (which included the TDSS rootkit). Afterward I had control of the desktop and was able to remove the remaining malware traces and undue the registry hacks in stages. In particular I found a tool called "Unhide.exe" which made the user data visible again. This was an interesting mess to unwind.
Thanks for posting back, Vivtek. Those googling for solutions will find this solution. In fact, I ran across this thread in a google search for the Vista Recovery virus to clean up a neighbor's laptop. And thanks to Jacee for her usual efficiency .

It's what makes it all work!

James
My System SpecsSystem Spec
Reply

 "Windows Vista Recovery" malware removal




Thread Tools






Similar help and support threads
Thread Forum
SD card reader works but no "removal of hardware" sound or icon
I have an Asus CM1630 desktop running windows 7, 64 bit. SD card reader works, after adding drive letter, but there is no hardware removal or insertion tone and the is no icon to safely remove the SD card. The SD card works fine when placed in an USB adapter and plugged into the USB port - there is...
Hardware & Devices
Windows Defender gave me a malware warning (file name = "hosts")
So... my Windows Defender gave me a warning earlier ago. It said I had an infected system file named "hosts". I already removed the file from my computer, but it can still be found on my history. Look: http://i.imgur.com/umsL5WX.png What is that malware about anyway? I know I already removed...
System Security
"Windows Error Recovery" System did not shut down properly
I've recently been getting this message when playing Rust and Sniper Elite V2, I also get it if I bump my computer desk too hard. I tried the "Last Known Good Configuration" fix but it didn't work, and I tried the "Repair Your Computer" option, but when I get to the log-in part, my keyboard won't...
Performance & Maintenance
"Windows failed to start..." Recovery disk is unable to recover Win.
Hi all. Earlier today I was playing around with Windows 8 Developer Preview inside of Virtualbox. I tried to install the VB guest additions (which allows copy-paste between guest and host, as well as other things) and was told to restart the computer. So I restarted the VM and got the new version...
BSOD Help and Support
Windows Vista/7 "Working In Background/"Busy" Cursor NO
Title is supposed to say that it is NOT animated. I recently purchased a Dell Studio 1737 direct from Dell. Every time I turn on my laptop and log into my account, there would be a blue, animated circle cursor indicating that the laptop was just turned on and that it is working in the...
General Discussion
Microsoft: Malware can disable UAC in Windows 7 "by design"
more: Microsoft: Malware can disable UAC in Windows 7 "by design"
News


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 16:17.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App