Q. I got a “Windows Recovery” virus – I removed it but now all my data folders are empty.

It sounds like you may not have completely removed the virus,  it doesn’t delete the files, but it hides your data folders and shows you fake empty folders. Follow these instructions to remove and repair Windows Recovery, SmartHDD, HDD Recovery, HDD Rescue, HDD Repair and other similarly named fake hard drive repair malware.

Windows Recovery malware screenshot

Follow these steps in this link one by one, do not skip any.
www.bleepingcomputer.com/virus-removal/remove-windows-recovery

(short summary for experienced virus removers, download and run RKill to kill the malware process, download and run Malwarebytes to delete the malware files.)

At the end, run Unhide download.bleepingcomputer.com/grinler/unhide.exe which should make your hidden folders reappear.

In order to avoid getting these fake system utility malware in the first place, I recommend blocking popup windows in your web browser software, and even better, switching to Firefox with NoScript add on which blocks scripts from running.  See the article on browser security here.

This entry was posted in Computer Questions and Answers, Security, Viruses and malware, Windows questions and tagged , , , , , , , , , , , , . Bookmark the permalink.

One Response to Q. I got a “Windows Recovery” virus – I removed it but now all my data folders are empty.

  1. Pingback: Q. What is Smart HDD and why does it say I have errors? | CanadaRAM: Memory and Computer Q&A

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.