Increasing Virtual Memory

There are instances when you might encounter an error that says, “Something went wrong, We couldn’t start your program” when you open any Office program. This could be due to an issue with the Office file and any Office app you open throws the same error message. This applies to Office 2019/2016, Office 365 Home, Office for Business as well as Business editions. In this post, you will be guided in what you can do to resolve this error. There are several potential fixes for this error, you might only have to restart your computer or you may have to repair Office from Apps and Features or you could also uninstall and install it back again. For more details, follow each one of the provided options below.

Option 1 – Restart your computer

You might be unable to launch any Office app due to some background process that got stuck or there might be some glitch in the system. Thus, the first thing you can do to resolve the error is simply restarting your computer. Once you’ve restarted your computer, open the Office app again or you could also try to sign in back with your Microsoft account that’s connected to Office. If you’re not quite sure which account you were using, you can follow these steps:

• Open any Office app.
• Then click on File and look for your name located in the top-right portion.
• Now click on it. This will display the email or Microsoft account that’s related to Office.

Option 2 – Try repairing Office from Apps and Features

Since Windows 10 offers some repair features that could replace some of the core files with the original files, you can take advantage of such a feature to fix the “Something went wrong, We couldn’t start your program” error when opening any Office app.

• Open Windows settings and click the Apps and Features option.
• Next, scroll down until you see the Microsoft Office installation option. Select it and click on Modify.
• This will open a window and from there, select Quick Repair or Online Repair and click on the Repair button.

Note: When you choose to repair, you might be given two options which depend on how Microsoft Office was installed. For instance, it was installed via Web Installer or Offline Installer (MSI-based). In Web Installer, select Online Repair > Repair when you’re prompted on how you would like to repair Office. While in MSI-based, you have to select Repair under “Change your installation” and then click on Continue. The repair process makes sure that the app data remains untouched.

Option 3 – Try to uninstall and reinstall Office

If neither of the two given options above worked, then you might want to uninstall Office and reinstall it. All you have to do is download the Microsoft Office Uninstall tool from the official site of Microsoft and run it. This will remove any incomplete Office installation as well as unwanted files. It will also get rid of all the Office apps and settings on your computer.

Google Chrome, Microsoft Edge, Mozilla Firefox are some of the leading browsers commonly used these days and they all include an embedded copy of the Adobe Flash Player. So if you are running a Windows 10 PC then you can have up to 4 copies of Adobe Flash Player; one for Microsoft Edge, one for Internet Explorer, one for Opera, one for Firefox. You might also experience cases wherein two flash players are simultaneously running, i.e. one installed in Chrome as a single plug-in and another one installed in Windows, trying to parse the data. And in such cases, you might consider removing or uninstalling one of the versions of Adobe Flash Player. If you do, then you’ve come to the right place as this post will guide you in disabling the embedded Adobe Flash Player in Windows 10. Before you get started in removing the Adobe Flash Player in Internet Explorer & Microsoft Edge browser, you need to sign in with your administrative account even if don’t use it or set it as the default browser. After you’ve signed in to your administrative account, follow the steps below. Step 1: Open your browser, if you are using Edge then open it. Step 2: After opening your browser, go to its Settings and select Advanced Settings. Step 3: Next, Move the slider against the “Use Adobe Flash Player” option to off. Step 4: After that, open File Explorer and navigate to this address, “C:/Windows/servicingPackages” and from there, check on the following entries:

• Adobe-Flash-For-Windows-Package~31bf3856ad364e35~amd64….(version number of the Flash Player)
• Adobe-Flash-For-Windows-WOW64-Package~31bf3856ad364e35~amd64….(version number of the Flash player #)
• Adobe-Flash-For-Windows-onecoreuap-Package~31bf3856ad364e35~amd64…(version number of the Flash Player)

Step 5: Take note of all the listed package names of Adobe Flash Player and tap the Win + R keys to open the Run dialog box and type “Regedit” in the field and hit Enter to open the Registry Editor. Step 6: Next, right-click on the three keys which have the name of the packages you listed and select “Permissions” one after the other. Step 7: Then check “Allow” to enable full control for the Administrators account and click OK to save the changes made. Step 8: Select the three keys one after the other and select Visibility DWORD located on the right side and then right-click on Visibility and change the Value data from 2 to 1. Step 9: Go over the same procedures again for the other keys. Once you’ve completed then you should now be able to remove packages using the DISM tool. Step 10: Simply open an elevated Command Prompt and execute the following commands:

• dism /online /remove-package /packagename:Adobe-Flash-For-Windows-Package~31bf3856ad364e35~amd64-10.0.17134.1
• dism /online /remove-package /packagename:Adobe-Flash-For-Windows-WOW64-Package~31bf3856ad364e35~amd64-10.0.17134.1
• dism /online /remove-package /packagename:Adobe-Flash-For-Windows-onecoreuap-Package~31bf3856ad364e35~amd64-10.0.17134.1

Keep in mind that the numbers at the end could be different on your computer due to the difference of version number so you have to use the numbers on your system. After that, reboot your computer.

If you are using a dual monitor setup on your computer and you wish to change the Primary and Secondary monitor in Windows 10, then you’ve come to the right place as this post will guide you on how exactly you can do that. A lot of users use more than one monitor to be more productive so having dual monitors helps a lot. So if you have more than one monitor, know that you can actually select any monitor as the primary monitor after installing Windows. Changing the primary and secondary monitor in Windows 10 does not really require you to install any third-party application since you can get the job done by simply making some alterations in the Windows 10 Settings panel. You won’t have any problem in making such alterations since it is quite simple – from modifying the wallpaper to scaling and so on.

To get started, follow the instructions given below carefully.

Step 1: First, tap the Win + I key combination to open the Windows 10 Settings app and go to System and click the Display tab. Step 2: Next, look for the Identify button located on your right-hand side and then click on it. This button will help you check which one is the primary and the secondary monitor. Step 3: After that, select the desired monitor that you want to set as the primary one from the drop-down menu. Step 4: After that, mark the checkbox for the “Make this my main display” option. Step 5: After choosing the primary monitor, this will automatically set the other monitor as the secondary monitor. Restart your computer. So that’s how you change the primary and secondary monitor on your Windows 10 computer. Note that you can always go back to the previous setting of your monitor by following the same instructions provided above.

WeatherGenie is a Browser Extension that allows users to check the current weather in any town at any time. This extension adds the “Weather:” search option to your new tab, and changes your default search engine to Yahoo.com. It also ads system Registry Entities that allow it to run each time the computer is restarted, several task schedulers are also added to allow it to run at various times during the day.

While installing this extension monitor browsing data from your computer. You may also see additional injected ads, sponsored links, and pop-up ads through your browser sessions. Weather games have been marked as a Browser Hijacker by several anti-virus scanners and are therefore not recommended to keep on your computer. It is flagged as potentially unwanted for optional removal.

About Browser Hijackers

Browser hijacking is a very common type of online fraud where your web browser settings are altered to allow it to do things you do not intend. Browser hijackers could do a variety of things on your PC. Often, hijackers will force hits to sites of their preference either to increase targeted traffic generating higher ad earnings, or to gain a commission for every user visiting there. Even though it might seem naive, all browser hijackers are harmful and thus always regarded as security risks. As soon as the malware attacks your computer or laptop, it begins to mess things up a whole that slows your system down to a crawl. In the worse case, you might be pushed to tackle serious malware threats too.

How you can know whether the web browser is hijacked?

Symptoms that an internet browser is hi-jacked include: 1. you notice unauthorized modifications to your web browser’s home-page 2. bookmark and the new tab are also changed 3. the essential web browser settings are modified and unwanted or insecure sites are put into the trusted sites list 4. you’re getting new toolbars you have never witnessed before 5. you’ll notice random pop-ups start showing on a regular basis 6. web pages load slowly and at times incomplete 7. you can’t navigate to particular web pages, such as security software-related websites.

How does a PC get infected with a browser hijacker?

There are a number of ways your PC can become infected with a browser hijacker. They usually arrive by way of spam e-mail, via file-sharing networks, or by a drive-by download. They can be included with toolbars, BHO, add-ons, plugins, or browser extensions. Other times you might have mistakenly accepted a browser hijacker as part of a software bundle (generally freeware or shareware). A good example of some popular browser hijackers includes Conduit, Anyprotect, Babylon, SweetPage, DefaultTab, RocketTab, and Delta Search, but the names are regularly changing. The existence of any browser hijacker on your system might substantially diminish the browsing experience, record your internet activities that lead to critical privacy concerns, diminish overall system performance and cause software instability as well.

The best ways to get rid of browser hijackers

Some browser hijacking can be simply reversed by identifying and eliminating the corresponding malware software from your control panel. But, many hijackers are harder to find or eliminate as they could get themselves connected with certain crucial computer files which allow them to operate as a necessary operating-system process. Besides, browser hijackers could modify the Computer registry so it could be very tough to repair manually, especially if you’re not a very tech-savvy individual. You can go for automatic browser hijacker removal by just installing and running a reliable anti-malware application. SafeBytes Anti-Malware discovers all kinds of hijackers – such as WeatherGenie – and eliminates every trace quickly and efficiently. Utilize a pc optimizer together with your antivirus software to repair various registry issues, remove system vulnerabilities, and improve your computer performance.

How To Get Rid Of Malware That Is Blocking Anti-Malware Installation?

Practically all malware is detrimental and the effects of the damage may vary based on the specific type of malware. Some malware goes to great lengths to stop you from downloading or installing anything on your PC, particularly anti-virus software programs. If you’re reading this, chances are you’re stuck with a malware infection that is preventing you to download or install the Safebytes Anti-Malware program on your system. Refer to the instructions below to get rid of malware through alternative ways.

Remove malware in Safe Mode

Safe Mode is actually a special, basic version of Windows where only bare minimum services are loaded to stop viruses and also other problematic programs from loading. In the event the malware is blocking internet access and affecting your computer, starting it in Safe Mode enables you to download anti-malware and run a scan whilst limiting possible damage. In order to enter into Safe Mode or Safe Mode with Networking, press the F8 key while the PC is starting up or run MSConfig and locate the “Safe Boot” options in the “Boot” tab. Once you’re in Safe Mode, you can attempt to install your anti-malware software without the hindrance of the malware. After installation, run the malware scanner to get rid of most standard infections.

Switch to an alternative internet browser

Some malware mainly targets specific internet browsers. If this is your situation, use another internet browser as it can circumvent the computer virus. The best solution to avoid this problem is to opt for a web browser that is well known for its security features. Firefox contains built-in Phishing and Malware Protection to help keep you safe online.

Make a bootable USB anti-virus drive

Here’s yet another solution which is using a portable USB anti-virus software that can scan your system for malware without needing installation. Follow these steps to employ a USB flash drive to clean your corrupted computer system. 1) Download the anti-malware on a virus-free PC. 2) Insert the USB drive on the same computer. 3) Double-click the Setup icon of the anti-malware program to run the Installation Wizard. 4) Choose the flash drive as the location for saving the file. Follow the instructions to complete the installation process. 5) Now, transfer the flash drive to the infected computer. 6) Run the Safebytes Anti-malware directly from the flash drive by double-clicking the icon. 7) Click on “Scan Now” to run a scan on the affected computer for viruses.

Top Features of SafeBytes Anti-Malware

Today an anti-malware tool can protect your computer or laptop from various forms of online threats. But how do choose the best one amongst several malware protection software that is available in the market? Perhaps you might be aware, there are several anti-malware companies and tools for you to consider. A few of them are great but there are many scamware applications that pretend as genuine anti-malware software waiting to wreak havoc on the computer. When searching for an anti-malware tool, pick one which provides dependable, efficient, and complete protection against all known computer viruses and malware. One of the highly recommended software is SafeBytes AntiMalware. SafeBytes carries a superb history of excellent service, and customers are happy with it. Safebytes is one of the well-established PC solutions companies, which offer this comprehensive anti-malware tool. When you have installed this software, SafeByte's sophisticated protection system will ensure that absolutely no viruses or malware can seep through your computer. SafeBytes anti-malware takes PC protection to a whole new level with its advanced features. The following are a few of the great ones: Active Protection: SafeBytes provides complete and real-time security for your PC. It will inspect your personal computer for suspicious activity at all times and shields your personal computer from illegal access. Robust Anti-malware Protection: Safebytes is based on the best virus engine within the industry. These engines can find and eliminate threats even during the early stages of a malware outbreak. Fast Scan: SafeBytes’s high-speed malware scanning engine reduces scanning times and extends battery life. Simultaneously, it’ll effectively identify and remove infected computer files or any online threat. Internet Security: SafeBytes checks and provides a unique safety ranking to every website you visit and block access to web pages considered to be phishing sites, thus safeguarding you from identity theft, or known to contain malicious software. Very Low CPU and Memory Usage: SafeBytes is a lightweight tool. It consumes a very small amount of processing power as it runs in the background so you are free to use your Windows-based PC the way you would like. Premium Support: For any technical issues or product assistance, you could get 24/7 professional assistance via chat and email. To conclude, SafeBytes Anti-Malware is pretty great for securing your laptop or computer against all sorts of malware threats. Malware problems will become a thing of the past when you put this software program to use. So if you’re looking for a comprehensive antivirus program that’s still easy to use, SafeBytes Anti-Malware is exactly what you will need!

Technical Details and Manual Removal (Advanced Users)

To remove WeatherGenie manually, navigate to the Add/Remove programs list in the Control Panel and choose the program you want to remove. For internet browser extensions, go to your browser’s Addon/Extension manager and choose the plug-in you wish to disable or remove. You’ll probably also want to reset your browser to its default configuration settings. In order to ensure the complete removal, manually examine your hard drive and Windows registry for all of the following and eliminate or reset the values as needed. Please keep in mind that only experienced users should attempt to manually edit the registry because deleting any single critical system file results in a serious problem or even a system crash. In addition, certain malware is capable of replicating or preventing deletion. It is advisable that you do the removal process in Safe Mode.

Error Code 38 – What is it?

Error Code 38 is a device driver error that users encounter on any Windows 2000 operating system and its following versions.

It occurs when the peripheral device that you connect to your PC cannot be accessed due to an inability of the Windows system to acknowledge the driver as a previous record of the driver being loaded is found in its memory.

It is a common error that users come across and appears on your PC with the following message:

“Windows cannot load the device driver for this hardware because a previous instance of the device driver is still in memory. (Code 38)”

Solution

Error Causes

Error Code 38 is prompted when incomplete program files are left in the Windows system which damage or corrupt its files. There are various factors that contribute to this, some of which are:

• An incomplete program installation
• An incomplete program uninstallation
• Hardware is not removed properly
• System recovery from viruses
• An improper system shut down

The above triggers are very likely to create incomplete files within the Windows registry thereby leading to its damage and corruption.

This is especially true in the case of your PC when it has recovered from viruses when using anti-virus software. The anti-virus in its effort to remove the virus also could remove the files which contain them thereby increasing the risk of the error code.

These damaged files can severely impact the health of your PC and are imperative to fix it immediately to prevent further problems.

Further Information and Manual Repair

Although this error code may pose serious problems for your PC, thankfully, it is very similar to other PC driver errors and thus is an easy one to get rid of. Here are various methods that you can use to get your PC running smoothly again.

Method 1 – Restart your PC

The easiest method you can use to solve your PC error code is to simply restart your PC. It may be that the error prompted upon connecting the device you have connected is merely a temporary problem, and upon restart, will resume functioning smoothly.

Method 2 – Run the Troubleshooting Wizard

If restarting your PC does not help, you will have to find the exact nature of the problem by running the troubleshooting wizard for the device and then address the problem accordingly. To do this, proceed with the following steps:

1. Run Device Manager on your PC
2. Click on the program under the installed programs that is creating problems for you
3. Click on the ‘General’ Tab
4. Click ‘Troubleshoot’
5. Upon opening, the Troubleshooting Wizard will ask a series of questions regarding the error. Answer the questions and follow its directions for solving the error code.

After following the directions of the Troubleshooting wizard, make sure to restart your PC for the changes to take effect. Now check if your device is still causing problems.

Method 3 – Use System Restore

If the error persists, you can use system restore to eliminate the problem. Here is how to do so:

1. Log in using an Administrator account
2. Click ‘Start’ button and select All Programs > Accessories > System Tools > System Restore
3. Click ‘Restore my computer to an earlier time’ and click ‘Next’
4. Select the last Windows to restore point from the ‘On this list, click a restore point’ list, and click ‘Next’
5. Click ‘Next’ on the confirmation window to proceed
6. Restart your PC after restoration is complete

By restoring the system via a last saved system checkpoint, you can obtain undamaged Windows system files that can help resolve the error code.

Method 4 – Manually uninstall and reinstall the device driver

If using system restore does not work either, you may have to resort to manually uninstalling and then reinstalling the device driver causing the problem.

This would be necessary since the remaining incomplete files due to a partial removal or installation of programs are responsible for the error code. By uninstalling and reinstalling the device driver program, it would lead to the completion of the files.

You can do this by firstly logging in as Administrator and opening Device Manager. Select the device that is causing the problem and double click it; make sure that the peripheral is connected properly to the PC.

Upon opening, click on the ‘Driver’ tab and then select ‘Update Driver’. Make sure to refer to the system documentation that you received with your PC or computer to check for the motherboard details and driver specifics.

Method 5 – Use software to automatically download the driver

Manually uninstalling and reinstalling the driver will do the trick; however, it may be time-consuming especially when you would have to resort to your hardware user manual.

Using a program such as DriverFIX can save you a lot of time and frustration in having your device to work properly on your computer.

DriverFIX, with its user-friendly approach to help you fix your PC issues, comes with an integrated database that detects which drivers you need to reconfigure within just a few seconds and downloads it automatically.

It further ensures that your drivers are installed in their entirety leaving no room for any incomplete files to remain that create Error Code 38, or any other driver-related errors for that matter.

It also has the added advantage of being able to backup and restores your files should there be the slightest possibility of system file damage. DriverFIX is the answer to fixing your PC error codes accurately and quickly.

Click here to download DriverFIX to fix Error Code 38 quickly and effectively!

Have you ever deleted a file by mistake? Do not feel bad, we all have, but what if you deleted the file by mistake and then you went to Recycle bin to restore it only to find out that the bin is empty? If you experienced this kind of issue then you know how unpleasant and frustrating it is but do not worry, we are here to help and provide you with solutions to this problem and hopefully get your file back. Follow the next steps from first to last since they are organized in a way to minimalize the permanent deletion of lost files.

1. Refresh Recycle bin view

   If you spend any amount of time on this site reading through articles, you know I am a big fan of simple and effective solutions and there is nothing simpler than a single press of a button. Open your recycle bin and press F5 to refresh view or right-click anywhere inside and choose refresh. If your file does not appear with this method go to the next step.

2. Set Windows to show hidden system files

   In order for this to work first, you will need to open File Explorer by pressing ⊞ WINDOWS + E When File Explorer opens go to VIEW > OPTIONS. Inside options select “Show hidden files, folders, and drives”, uncheck “Hide protected operating system files (Recommended)”, and click APPLY > OK Go to the recycle bin and check to see if files have managed to show up.

3. Check if Don't move the file to the recycle bin is enabled

   Right-click on recycle bin and choose properties, under properties, there is the option that says Don’t move files to the Recycle Bin, Remove files immediately when deleted. This option is not selected by default, but it could be turned on by someone else or by mistake. If you see that this option is enabled sadly your file is gone and you will have to get the file back by using some third-party undelete application, uncheck this option to prevent future deletion of files by mistake.

4. Increase recycle bin size

   This will not help you to get your file back sadly but it will help you in storing more files in recycle bin. This is helpful since if you reach your recycle bin limit all further files will be permanently deleted and not been able to get them back. So by increasing bin size you will have more space for deleted files to be saved. To do that, right-click on Recycle Bin, select Properties. Now, increase the Maximum size from the Custom size option, and click Apply and OK.

5. Reset recycle bin

   To reset and fix corrupted recycle bin do the following: Press ⊞ WINDOWS + X to open the secret Windows menu and click on command prompt (admin) In the command prompt type in the following: rd /s /q C:\$Recycle.bin Reboot your system

Error 2738 - What is it?

Error 2738 is associated with the VBScript engine. VBScript is the abbreviation for Visual Basic Scripting. It is an Active Scripting programming language developed by Microsoft and modeled on Visual Basic. It is used with a fast interpreter in a large variety of Microsoft environments. Error 2738 indicates that the VBScript engine is not registered properly on your PC. It occurs when you try to install or uninstall VBScript-supported applications on your system. The error message is displayed in the following format:

"Error 2738. Could not access VBScript run time for custom action."

Solution

Error Causes

There are several reasons for the error 2738 message pop up. These include: Incorrect or corrupt registry entries on your system. These entries interfere with VBScript support in Windows thereby generating such error codes.

• Removal of McAfee Antivirus
• Windows registry values are not updated accurately during the uninstallation of McAfee Software
• The Visual Basic Script is registered in the registry under the local user instead of the local machine

No matter what the cause of the error may be, it is recommended that you resolve the issue immediately without any delay.

Further Information and Manual Repair

Here are some of the easy and proven DIY methods to repair error 2738 on your PC:

Method 1

If the error 2738 occurs because the VBScript is not registered correctly, then follow these steps to resolve.

1. Go to the start menu, open Run, and type RegEdit in the box and then press OK. This will open the Windows Registry Editor.
2. Now type KEY_LOCAL_MACHINESOFTWAREClassesCLSID{B54F3741-5B07-11cf-A4B0-00AA004A55E8}InprocServer32, if the key does not have a data value of C:\Windows\System32\vbscript.dll then simply add it.
3. Now go to the All programs option and then Accessories.
4. Here right-click on Command Prompt and then ‘Run as Administrator’.
5. Now type egsvr32 vbscript.dll then press enter. After that type regsvr32 jscript.dll and then press enter.
6. Restart your PC to activate changes.

Method 2

Sometimes error 2738 may occur when you uninstall preinstalled MacAfee antivirus software on your system. Un-installation usually leaves some trace components in the registry. These components must be removed completely otherwise error codes like 2738 may keep occurring on your computer screen. In such an event, the best way to resolve it is to download the McAfee Consumer Product Removal utility from McAfee's official website. Save this file on your desktop. Double click the file and follow the steps to remove this software completely and successfully from your PC. Proper removal of the McAfee program will resolve error 2738 right away. But if the error still persists then try other methods illustrated below.

Method 3

Download Restoro to remove incorrect and corrupt registry entries on your system that may be interfering with VBScript support. Restoro is a new and easy-to-use PC Repair Tool deployed with an intuitive interface and a powerful registry cleaner. The registry cleaner removes all entries corrupting the registry, cleans it, and resumes it to its normal state. Click here to download Restoro.

Windows photo viewer was a popular photo viewing application integrated into Windows 7, 8, and 8.1 but in Windows 10 it has been replaced with photos, Microsoft's new application aimed at photo viewing on your desktop. Now if any one of you wonders why should be bringing the old application back to Windows 10 since we have an alternative one, the answer would be resources and speed. The old photo viewer application is lightweight, fast, and reliable, opening the same photo in both photo viewer and in new photos shows us that Microsofts new viewer application takes even three times more RAM, and it's visibly slower in loading times for pictures. Since I am a person who prefers speed and functionality over fancy looks I would be very glad to have the option to bring back a photo viewer. If you have by any chance Windows 10 as an upgrade, bringing back photo viewer is easy as 1,2,3. you just need to open settings and go to default apps, under photo viewer you should see your current default viewing application, probably photos, click on it to see options and choose photo viewer and exit the Settings menu, and you're done. Sadly if Windows 10 has been installed clean on the system and not as upgrade things are a little bit more complicated but do not worry, stay with us, keep reading and you will get there.

Activating photo viewer

How technically photo viewer is still in the system but not used we will have to make it available again and this we will do by adding some lines in the Windows registry, that being said, open a notepad and paste the following code as it is in it.

---

Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\jpegfile\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\pngfile\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open] "MuiVerb"="@photoviewer.dll,-3043" [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Bitmap] "ImageOptionFlags"=dword:00000001 "FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\ 00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\ 77,00,73,00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,\ 00,65,00,72,00,5c,00,50,00,68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,\ 65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,35,00,36,00,00,\ 00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Bitmap\DefaultIcon] @="%SystemRoot%\\System32\\imageres.dll,-70" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Bitmap\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Bitmap\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print] "NeverDefault"="" [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print\DropTarget] "Clsid"="{60fd46de-f830-4894-a628-6fa81bc0190d}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF] "EditFlags"=dword:00010000 "ImageOptionFlags"=dword:00000001 "FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\ 00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\ 77,00,73,00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,\ 00,65,00,72,00,5c,00,50,00,68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,\ 65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,35,00,35,00,00,\ 00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\DefaultIcon] @="%SystemRoot%\\System32\\imageres.dll,-72" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\shell\open] "MuiVerb"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\ 69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\ 00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,\ 72,00,5c,00,70,00,68,00,6f,00,74,00,6f,00,76,00,69,00,65,00,77,00,65,00,72,\ 00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,34,00,33,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Jpeg] "EditFlags"=dword:00010000 "ImageOptionFlags"=dword:00000001 "FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\ 00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\ 77,00,73,00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,\ 00,65,00,72,00,5c,00,50,00,68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,\ 65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,35,00,35,00,00,\ 00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Jpeg\DefaultIcon] @="%SystemRoot%\\System32\\imageres.dll,-72" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Jpeg\shell\open] "MuiVerb"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\ 69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\ 00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,\ 72,00,5c,00,70,00,68,00,6f,00,74,00,6f,00,76,00,69,00,65,00,77,00,65,00,72,\ 00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,34,00,33,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Jpeg\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Jpeg\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Gif] "ImageOptionFlags"=dword:00000001 "FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\ 00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\ 77,00,73,00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,\ 00,65,00,72,00,5c,00,50,00,68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,\ 65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,35,00,37,00,00,\ 00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Gif\DefaultIcon] @="%SystemRoot%\\System32\\imageres.dll,-83" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Gif\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Gif\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Png] "ImageOptionFlags"=dword:00000001 "FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\ 00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\ 77,00,73,00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,\ 00,65,00,72,00,5c,00,50,00,68,00,6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,\ 65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,35,00,37,00,00,\ 00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Png\DefaultIcon] @="%SystemRoot%\\System32\\imageres.dll,-71" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Png\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Png\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Wdp] "EditFlags"=dword:00010000 "ImageOptionFlags"=dword:00000001 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Wdp\DefaultIcon] @="%SystemRoot%\\System32\\wmphoto.dll,-400" [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Wdp\shell\open] "MuiVerb"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\ 69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\ 00,20,00,50,00,68,00,6f,00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,\ 72,00,5c,00,70,00,68,00,6f,00,74,00,6f,00,76,00,69,00,65,00,77,00,65,00,72,\ 00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,33,00,30,00,34,00,33,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Wdp\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.Wdp\shell\open\DropTarget] "Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}" [HKEY_CLASSES_ROOT\SystemFileAssociations\image\shell\Image Preview\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\ 6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\ 00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\ 25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\ 00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\ 6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\ 00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\ 5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\ 00,31,00,00,00 [HKEY_CLASSES_ROOT\SystemFileAssociations\image\shell\Image Preview\DropTarget] "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities] "ApplicationDescription"="@%ProgramFiles%\\Windows Photo Viewer\\photoviewer.dll,-3069" "ApplicationName"="@%ProgramFiles%\\Windows Photo Viewer\\photoviewer.dll,-3009" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations] ".cr2"="PhotoViewer.FileAssoc.Tiff" ".jpg"="PhotoViewer.FileAssoc.Jpeg" ".wdp"="PhotoViewer.FileAssoc.Wdp" ".jfif"="PhotoViewer.FileAssoc.JFIF" ".dib"="PhotoViewer.FileAssoc.Bitmap" ".png"="PhotoViewer.FileAssoc.Png" ".jxr"="PhotoViewer.FileAssoc.Wdp" ".bmp"="PhotoViewer.FileAssoc.Bitmap" ".jpe"="PhotoViewer.FileAssoc.Jpeg" ".jpeg"="PhotoViewer.FileAssoc.Jpeg" ".gif"="PhotoViewer.FileAssoc.Gif" ".tif"="PhotoViewer.FileAssoc.Tiff" ".tiff"="PhotoViewer.FileAssoc.Tiff"

---

Yup, that is a lot of keys and settings but you are almost done. Once you have pasted text into your new notepad document save it but as .REG, you can name it however you want but it has to be .REG extension. Once the file is saved double click on it to merge it into the Windows registry. You might need to turn off UAC for this operation (check our tutorial on this topic) and accept warning messages but once it is done you should now have an old photo viewer as a choice for your default viewing application. All you have to do now is to go to settings and go to default apps, under photo viewer you should see your current default viewing application, probably photos, click on it to see options and choose photo viewer and exit the Settings menu, and you're done.

As you know, System Restore is a useful tool in Windows operating system that helps users in fixing system issues by undoing any recent changes to the computer that may have caused the problem. However, there are times when you might encounter some issues when running this tool and one of these issues is when System Restore suddenly gets stuck or hangs up on initializing the restoration of the Registry in Windows 10. If you encounter a similar problem, read on as this post will guide you on what you can do in such cases. There are several things you can do when you face this kind of problem in System Restore. First, you can try to wait it out, give it more time to load, which should not take longer than 5 minutes. And if it’s still stuck after that time, give it another hour. However, if nothing changed after an hour, then you need to troubleshoot the problem further. Keep in mind that you must not interrupt System Restore by shutting it down abruptly, it could result in an unbootable system. To get started in troubleshooting the problem, you need to follow each one of the suggestions offered below.

Option 1 – Try to use the Windows Recovery Environment

The first troubleshooting option you need to try is to simply tap the power button for about 10 seconds. This is what you have to do when you have to interrupt System Restore or reset your Windows 10 computer. Tapping the power button for 10 seconds will perform a hard shutdown and once your computer shuts down, restart your computer again and follow the steps below but before you do that, make sure that you have a Windows bootable USB or DVD.

• First, insert the bootable USB or DVD and boot into it, and select the “Repair your computer” option.
• Next, once you see the manufacturer logo on your computer, tap the key to enter into Windows Recovery Environment.
• After that, change the Boot sequence to DVD drive under the UEFI Firmware settings and restart your computer.
• Once your computer has restarted, select the boot order and make changes accordingly as displayed in the BIOS.

Option 2 – Try to run the Automatic Repair Utility

You might also want to use Automatic Repair in fixing the error. To do so, follow the steps below.

• You can start by creating and booting from a bootable Windows 10 USB Stick.
• After that, click on Repair your computer located on the bottom left corner when you are on the initial Windows Startup screen.
• Next, click on Troubleshoot, and then on the other screen, click the Startup Repair option.
• Now select the operating system you want to repair. Once you do that, it will start to repair your operating system. Wait until the process is completed and then check if the problem’s now fixed.

Option 3 – Try to run System Restore in Safe Mode

If you can’t boot into your Windows 10 computer, you can try to run System Restore again in the Advanced Startup Options.

• Boot your computer into Safe Mode.
• After that, select an option > Troubleshoot > Advanced Options > Startup Settings > Restart.
• Once your computer has restarted, tap the F6 key to enable Safe Mode with Command Prompt and to run System Restore from there.
• Now in Command Prompt, type the “rstrui.exe” command to run System Restore in Safe Mode. This will help in fixing the problem since it would be safer to perform System Restore of the computer.

What is PyLocky ransomware? And how does it execute its attack?

PyLocky ransomware is a file-locking malware created in order to lock important files and demand ransom from victims in exchange for data recovery. This new ransomware uses the .lockymap extension in marking the files it encrypts. It starts to execute its attack by dropping the following malicious payload in the system:

Name: facture_4739149_08.26.2018.exe SHA256:8655f8599b0892d55efc13fea404b520858d01812251b1d25dcf0afb4684dce9 Size: 5.3 MB

After dropping its malicious payload, this crypto-malware connects the infected computer to a remote server where it downloads more malicious files and places them on system folders. It then applies a data gathering module used to gather data about the user and the computer. The malicious files that were downloaded earlier along with the data obtained are used for another module called stealth protection. This allows PyLocky ransomware to execute its attack without detection from any security or antivirus programs installed in the system. It also modifies some registry keys and entries in the Windows Registry such as:

• HKEY_CURRENT_USERControl PanelDesktop
• HKEY_USERS.DEFAULTControl PanelDesktop
• HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
• HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce

Once all the modifications are carried out, PyLocky ransomware will begin encrypting its targeted files using a sophisticated encryption cipher. Following the encryption, it adds the .lockymap extension to each one of the encrypted files and releases a ransom note named “LOCKY-README.txt” which contains the following content:

“Please be advised: All your files, pictures document and data has been encrypted with Military Grade Encryption RSA ABS-256. Your information is not lost. But Encrypted. In order for you to restore your files, you have to purchase a Decrypter. Follow these steps to restore your files. 1* Download the Tor Browser. ( Just type in google “Download Tor“ 2‘ Browse to URL: http://4wcgqlckaazungm.onion/index.php 3* Purchase the Decryptor to restore your files. It is very simple. If you don’t believe that we can restore your files, then you can restore 1 file of image format for free. Be aware the time is ticking. Price will be doubled every 96 hours so use it wisely. Your unique ID : CAUTION: Please do not try to modify or delete any encrypted file as it will be hard to restore it. SUPPORT: You can contact support to help decrypt your files for you. Click on support at http://4wcgqlckaazungm.onion/index.php”

How does PyLocky ransomware spread over the web?

PyLocky ransomware spreads using malicious spam email campaigns. Creators of this threat embed an infected attachment to spam emails and send them using a spambot. Crooks may even use deceptive tactics to trick you into opening the malware-laden immediately which is something you must not do. Thus, before opening any emails, make sure that you’ve thoroughly checked them. To successfully obliterate PyLocky ransomware from your computer, refer to the removal guide laid out below.

• Step 1: Launch the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
• Step 2: Under the Task Manager, go to the Processes tab and look for the process named facture_4739149_08.26.2018.exe and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to PyLocky ransomware.
• Step 3: After that, close the Task Manager.
• Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
• Step 5: Under the list of installed programs, look for PyLocky ransomware or anything similar, and then uninstall it.
• Step 6: Next, close the Control Panel and tap Win + E keys to launch File Explorer.
• Step 7: Navigate to the following locations below and look for PyLocky ransomware’s malicious components such as facture_4739149_08.26.2018.exe and LOCKY-README.txt as well as other suspicious files, then delete all of them.

%TEMP% %WINDIR%System32Tasks %APPDATA%MicrosoftWindowsTemplates %USERPROFILE%Downloads %USERPROFILE%Desktop

• Step 8: Close the File Explorer.
• Step 9: Tap Win + R to open Run and then type in Regedit in the field and tap enter to pull up Windows Registry.
• Step 10: Navigate to the following path:

HKEY_CURRENT_USERControl PanelDesktop HKEY_USERS.DEFAULTControl PanelDesktop HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce

• Step 11: Delete the registry keys and sub-keys created by PyLocky ransomware.
• Step 12: Close the Registry Editor and empty the Recycle Bin.

Try to recover your encrypted files using the Shadow Volume copies Restoring your encrypted files using Windows Previous Versions feature will only be effective if PyLocky ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot. To restore the encrypted file, right-click on it and select Properties, a new window will pop up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.