Disable widgets menu inside Windows 11

If you got an Activation Error 0xC004F211 after having installed or upgraded your Windows 10 PC, then this indicates that some hardware in your computer has changed which’s causing the error to pop up. Windows might not be able to determine if the key is used on a new computer or if it’s still the same one if you have just removed or upgraded old hardware. But worry not for this post will guide you in fixing the Windows Activation Error 0xC004F211 on your Windows 10 computer. When you encounter this error, you will see the following error message on your screen:

“Cannot activate Windows 10. Try activating again later. If that doesn’t work, contact support. Error code: 0xC004F211.”

Note that although hardware changes cause this error, the minor ones don’t really cause any issues with activation, however, if you have made any significant hardware change such as replacing your motherboard, it will most likely cause the activation error. In such cases, the Windows Activation system will treat this as new hardware and you will need a new license for that. Even if your Windows 10 computer has a genuine key, it might still fail to get activated which results in the Windows Activation Error 0xC004F211. Thus, before you do other troubleshooting steps, you need to run the Windows 10 Activation Troubleshooter first. To do so, follow these steps:

• Go to Settings and then select Activation.
• After that, click on the Windows Activation and then troubleshoot. This will help you address most of the commonly found activation issues in Windows devices.

In addition, there is an exception offered by Microsoft – if you are connected to a Microsoft account prior to the hardware change, then you can most certainly use the same license key to reactivate Windows 10 again. Microsoft calls this an “Exception path” which should be fixed easily by the Windows Activation Troubleshooter as pointed out earlier. However, if the Windows Activation Troubleshooter isn’t able to resolve the error you can try purchasing a new license. In such rate case, even if you do have a Microsoft account available on your Windows 10 computer, and if Windows was never activated, this solution will not work. And if you haven’t connected your Microsoft account with your Windows 10 computer prior to the major hardware change, then your only option left is to purchase a new license. For you to do that here are some steps you can follow.

• To purchase a new Windows license, the first thing you have to do is click on the Start button > Settings > Update & Security.
• From there, go to Activation and select the “Go to Microsoft Store” option.
• After receiving your new license, you need to go back to Update & Security then go to Activation and select the “Change product key” option.
• Now update your Windows 10 computer using the new key and it should automatically activate your computer.
• Next, you have to create a Microsoft account or connect your existing local account to your online account.
• Once the system links the key and the account, you need not buy a new license in case something like this happens again.

Note: If you are an IT administrator, you need to keep in mind that there is a limit to the number of times you can reactivate Windows on your computer. Moreover, if you don’t see any option to reactivate the license, and it is a work computer, you need to contact your organization’s tech support.

If you like to schedule different tasks on your Windows 10 computer and automate them, then you would find the Windows Task Scheduler very useful. It is commonly used by a lot of users to schedule various tasks like scheduling periodic execution of scripts and some programs to make sure that the intended tasks are automatically carried out. Apart from being a preinstalled application, the Task Scheduler is already available on your computer. However, there are times when you might encounter some errors while using it. One of these errors is error 0xFFFD0000. You can encounter this error while executing some PowerShell scripts. It can occur to any tasks as well especially to the ones that have a file executed using a particular program. And just like the PowerShell script, files also use PowerShell to be executed. To fix Error 0xFFFD0000, you need to follow the instructions provided below carefully. Step 1: In the Start Search, type “task scheduler” and click on Task Scheduler from the results to open it. Step 2: After opening Task Scheduler, right-click on the task that’s giving you the error and then click on Properties. Step 3: After that, navigate to the Actions tab in the new mini window that appears. Step 4: From there, select the action for the task and click on the Edit button which will open another mini window. Step 5: Next, make sure that the path to the executing program is properly typed inside the field of Program/script. Note that it should be set to the executable file for that particular program. For instance, you have to set it to “C:WindowsSystem32WindowsPowerShellv1.0powershell.exe” for the Windows PowerShell program. Step 6: You can also utilize the Browse button and navigate through Windows Explorer to locate that particular executable file for the program. Step 7: Now make sure to use the file argument in the Add arguments field followed by the path of the file to be executed. It should look like this:

-file "C:/Users/Ayush/Desktop/Powershell Script Sample.ps1"

Step 8: Once done, click on OK to save the changes made and see if the task is still giving you an error or not. On the other hand, if you are still getting the same error, you can try to repair the Task Scheduler by deleting corrupted tasks. Note that a single corrupted file can cause big problems so this option is quite important. And for you to delete a corrupted task or any task from the Task Scheduler, you have to use the Registry Editor if you are not able to use the Task Scheduler interface. To do so, follow these steps:

• Tap the Win + R keys to open the dialog box for Run.
• Next, type in regedit and click on OK or tap Enter to open the Registry Editor.
• Then navigate to this path: ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheTree

Note: In this path, you can see all the tasks that are currently set in the Task Scheduler. And since it would be hard to tell which one of them is corrupted, you have to delete the latest one in Task Scheduler last. But before you do so, make sure that you take a note of the ID of the tasks. And for you to get the ID, you have to select the task you wish to delete and double click on the ID string located on your right-hand side, and then copy it in the Notepad.

• Right-click on the task name and then delete it.
• After that, delete the very same GUID which you have copied earlier from these folders:
• ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheBoot
• ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheLogon
• ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheMaintenance
• ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCachePlain
• ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheTasks

Note: You might not see the same GUID from these folders but if you see it, delete it right away.

• Next, navigate to this location: C:WindowsSystem32Tasks
• Delete the very same tasks you just deleted from the Registry Editor.
• Restart your PC and check if the Task Scheduler is back to its normal state or not.

Missing Dciman32.dll Error – What is it?

Dciman32.dll is a type of dynamic link library. Just like any other dll file, it includes instructions and is called to load and run different programs. The Missing Dciman32 dll error code occurs when the program dependent on this dll file type is unable to load the file. This error can occur while using or installing certain programs on your system.

• "Dciman32.dll Not Found"
• "Cannot find [PATH]dciman32.dll"
• "This application failed to start because dciman32.dll was not found. Re-installing the application may fix this problem."
• "The file dciman32.dll is missing."
• "Cannot start [APPLICATION]. A required component is missing: dciman32.dll. Please install [APPLICATION] again."

Solution

Error Causes

The Dciman32.dll error causes include:

• Dciman32.dll file corruption or removal
• Poor program installation that uses Dciman32.dll file
• Registry issues
• Hardware failure
• Malware infection

Further Information and Manual Repair

Here are some of the easiest and effective ways to fix the Dciman32 dll error on your PC:

Method 1 - Restore Dciman32 dll file Back on your PC

Remember DLL files are shared files. You might have deleted this file while uninstalling some other program on your PC. Therefore to restore Dciman32.dll file, first check your recycle bin. If you locate it, then that’s great however if you don’t, then another way to restore the Dciman32.dll file is to download it from the internet.

Method 2 - Update Drivers for Hardware Devices

To update the driver first download the latest drivers from the hardware manufacturer’s website. Now go to the start menu, then the control panel and then click the device manager. Once you open the device manager, locate the hardware device you want to update the driver for. For example, if you experience a Dciman32 dll error when you play a 3D video game, then this indicates that you need to update the drivers for your video card. Navigate through different categories of hardware devices by clicking the icon to find the hardware you want to update. After finding the hardware you’re updating the driver for, right-click on the hardware’s name and then choose properties and then the driver tab. Click update driver button. This method will take approximately 10 to 12 minutes. To activate the changes you will have to restart your PC.

Method 3 - Reinstall the Program that Uses Dciman32.dll File

Another way to resolve the Dciman32.dll error code on your system is to reinstall the program showing the error message. Poor program installation can also be the reason for the error occurrence. To reinstall the program, first, you will have to uninstall the program showing the error message, and then restart your PC to activate changes. Once your computer restarts, reinstall the deleted program. Make sure that the disc or the CD you are reinstalling the program from is bug-free and not scratched.

Method 4 - Scan your PC for Registry Issues and Viruses

If the dll error still persists, then this means either the error is triggered by viruses or registry issues. To resolve these issues you will have to install and run programs on your PC antivirus and a registry cleaner. However, you should note that installing too many programs can slow down your system’s performance.

Restoro

The best way to scan for viruses and registry issues without compromising your PC performance is to download Restoro. This is a multi-functional PC Fixer embedded with 4 powerful and unique PC repair utilities including an antivirus that scans all kinds of viruses, Trojans, and malware. It also features a registry cleaner that removes all unwanted files saved in the registry, cleans the registry, repairs the damaged dll and system files including the Dciman32.dll file, and restores them back to normal. Furthermore, to ensure your system performance at its optimum level, it is also embedded with a system optimizer. And forth utility it features is Active X controls and class scanner. This is a safe and a user-friendly program compatible with all Windows versions. Click here to download Restoro now.

USB storage devices are used to store small and even big files, depending on their sizes. Usually, the sizes of the USB vary from 2GB up to 16GB. And as time passes, they have advanced quite a bit and now it’s common to find USB sticks with a capacity of 32GB, 64GB, or even 128GB. And since they now have large capacities, USB storage devices are often used for storing backups of system data as well as creating an image. However, there are times when you might encounter an error message while trying to create a backup or image on your USB device. The error message states:

“The drive is not a valid backup location.”

One of the causes of this problem is that Windows was not able to recognize the USB drives as a valid backup location since USB storage devices weren’t previously large enough to store system images. To fix this error, here are some possible solutions that might help.

Option 1 – Try creating a sub-folder in the USB drive and backup all the images there

The first thing you can try to do is to create a sub-folder on your USB device. This is one good way you can bypass the USB drive limitation. How? Refer to the steps below.

• First, right-click on the USB storage device and select Format.
• Next, select NTFS as the File System and check the box next to Quick Format.
• After that, click on Start to initiate the formatting process.
• Once the formatting process is completed, open the USB drive and right-click anywhere inside its main drive window, and then select New > Folder.
• Then name the folder to be created as “Image (or anything you please)”.
• Afterward, right-click on the folder and select Properties.
• From there, go to the Sharing tab and click on Share.
• Now check if the Permission level on the System owner which should be your username is labeled as “Owner”.
• Then try to back up your files again using your USB drive while keeping the sub-folder as the backup location.

Option 2 – Update the USB Controller Drivers

• First, click the Start button and type “device manager”.
• Then click on the “Device Manager” from the search results to open it.
• From there, look for the “Universal Serial Bus controllers” option and then right-click on each one of the USB drivers and select the Update Driver from the menu.
• Restart your PC and then click the “Search automatically for updated driver software” option.

You also have the option to update the motherboard and the USB driver from the manufacturer’s official website.

Option 3 – Run CHKDSK utility to check the drive for errors

When it comes to some issues concerning the hard drive or removable devices, there is a utility in Windows that might help which is called “chkdsk”. To use it, follow the steps below.

• Tap the Win + S keys to open the Search box.
• Then type “command prompt” in the field and from the search results that appear, right-click on Command Prompt and select “Run as administrator”.
• After opening an elevated command prompt, copy and paste the following command and hit Enter:

CHKDSK [volume [[path] filename]] [/F] [/V] [/R] [/X] [/C] [: size]]

Note: In the command given above, “[/F]” will try to fix the system errors while “[/R]” will be the one to fix the bad sectors.

• Now if you are prompted to run CHKDSK after your reboot your PC, just tap Y and reboot your PC.
• If CHKDSK is not able to find any errors, tap the Win + E keys and navigate the access window. From there, right-click on the concerned drive and click on Properties.
• After opening Properties, click on the tab Tools and then click on the “Check” button under the Error-checking section.
• Wait until the process is completed and then restart your computer.

I do not know about you, but I prefer to set my Windows to be more to my liking and not how Microsoft thinks it should be. Let’s face it, not all users feel comfortable whit Microsoft settings and idea how things should be. One of the things I particularly did not like even in Windows 10 is icons that come by default on my taskbar, now so far, well until the latest Windows 11 update you could remove default taskbar icons the same way as in Windows 10, just right-click on them and unpin, sadly with latest update build on Windows 11 this option has been removed. In order to remove default icons from the taskbar, one must go now to Windows 11 settings and choose from there which one you would like to be placed on it. Of course, this is nothing game-breaking but it still feels strange why the standard option has been removed, it just makes no sense but lately not many things that come from Microsoft do. I do not know about you, but I prefer to set my Windows to be more to my liking and not how Microsoft thinks it should be. Let’s face it, not all users feel comfortable whit Microsoft settings and idea how things should be. One of the things I particularly did not like even in Windows 10 is icons that come by default on my taskbar, now so far, well until the latest Windows 11 update you could remove default taskbar icons the same way as in Windows 10, just right-click on them and unpin, sadly with latest update build on Windows 11 this option has been removed. In order to remove default icons from the taskbar, one must go now to Windows 11 settings and choose from there which one you would like to be placed on it. Of course, this is nothing game-breaking but it still feels strange why the standard option has been removed, it just makes no sense but lately not many things that come from Microsoft do.

If you suddenly encountered Error Code 0xc1900130 while trying to update your Windows 10 computer, read on for this post will help you fix the problem. This kind of Windows Update error may occur when the network connection between the Windows Update server and the client machine is interrupted and the install can’t continue since the instance hash was not found. In such cases, you will see the following error message in Settings:

“Failed install attempt – 0xc1900130”

Here are the technical details of the error:

“Error Code: 0XC1900130 Message: MOSETUP_E_INSTALL_HASH_MISSING Description: The install cannot continue because the instance hash was not found.”

If you are currently facing this problem when you tried to install a Feature Update, you might have to check your internet connection and then try to install the Windows Update again. However, if it didn’t work, then you can refer to each one of the given options below to fix the error.

Option 1 – Reset the Windows Update components

If by any chance that the second option didn’t work, resetting the Windows Update components could also help you resolve the problem. How? Refer to the following steps:

• Open Command Prompt with admin privileges.
• After that, type each one of the following commands and hit Enter after you key in one after the other.
  • net stop wuauserv
  • net stop cryptsvc
  • net stop bits
  • net stop msiserver

Note: The commands you entered will stop the Windows Update components such as Windows Update service, Cryptographic services, BITS, and MSI Installer.

• After disabling WU components, you need to rename both the SoftwareDistribution and Catroot2 folders. To do that, type each one of the following commands below, and don’t forget to hit Enter after you type one command after the other.
  • ren C:WindowsSoftwareDistribution SoftwareDistribution.old
  • ren C:WindowsSystem32catroot2 Catroot2.old
• Next, restart the services you’ve stopped by entering another series of commands. Don’t forget to hit Enter after you key in one command after the other.
  • net start wuauserv
  • net start cryptsvc
  • net start bits
  • net start msiserver
• Close Command Prompt and reboot your PC.

Option 2 – Try configuring the Windows Update-related Services

• Tap the Win + R keys to open the Run dialog box.
• Then type “cmd” in the field and tap Enter to open an elevated Command Prompt.
• Next, execute the following commands. Note that you have to type and enter each command one after the other.
  • SC config wuauserv start= auto
  • SC config bits start= auto
  • SC config cryptsvc start= auto
  • SC config trustedinstaller start= auto
• The commands you executed will make sure that the Windows Update-related services are available. Once it’s done, restart your computer and see if the Windows Update error is now fixed.

Option 3 – Try downloading and installing the Windows Updates manually

Windows Upgrade Error Code 0xc1900130 might be due to a Windows Update that has failed. So if it is not a feature update and only a cumulative update, you can download the Windows Update and install it manually. But first, you need to find out which update has failed, and to do so, refer to the following steps:

• Go to Settings and from there go to Update and Security > View Update History.
• Next, check which particular update has failed. Note that Updates that have failed to install will be displayed under the Status column which has a label of “Failed”.
• After that, go to the Microsoft Download Center and look for that update using its KB number and once you find it, download and then install it manually.

Note: You can also use the Microsoft Update Catalog, a service from Microsoft that provides a list of software updates that can be distributed over a corporate network. With the help of this service, it can be easier for you to find Microsoft software updates, drivers as well as fixes.

Option 4 – Try to run the Windows Update troubleshooter

Windows 10 have various troubleshooters that can help you resolve many system issues. So if you’re dealing with Windows Update errors like Error Code 0xc1900130, you can run the Windows Update troubleshooter to resolve it. To run it, go to Settings and then select Troubleshoot from the options. From there, click on Windows Update and then click the “Run the troubleshooter” button. After that, follow the next on-screen instructions and you should be good to go.

Option 5 – Try to flush the DNS cache

You could also try to flush the DNS cache as it might fix the problem. To do so, follow these steps:

• Right-click on the Start button and click on Command Prompt (administrator) so you can pull up an elevated Command Prompt.
• After that, execute the following command to flush the DNS cache

ipconfig /flushdns

• Next, restart your PC and check if the problem’s fixed.

Note: You might also check your internet connection or reboot your router or plug out and then plug in your Ethernet connection manually to verify the reliability of your internet connection since intermittent connection could also cause Windows Update errors like Error Code 0xc1900130.

The GameStream is an NVIDIA service that allows users to stream games from their Windows 10 computers to other supported devices which includes the NVIDIA SHIELD devices. However, a number of users reported that the NVIDIA GameStream is not working on their Windows 10 computers. This kind of issue is most likely caused by improper installation, some glitches with the network, and many more. To fix this issue in the NVIDIA GameStream, there are several options you need to check out to fix the problem. You can try to lo logout of GameStream and try logging back in again. You could also try to update or uninstall and reinstall the drivers related to NVIDIA or fix some network glitches or update the NVIDIA SHIELD device. For more details, you can refer to each one of the given potential fixes below.

Option 1 – Try to logout and log back into NVIDIA GameStream

The first thing you can do is to log out and then log back into NVIDIA GameStream. Some users claimed that by doing this simple task, they were able to resolve the problem. This is probably because with the re-login, the entire cache of the system and service is rebuilt and any bad sectors of that data will be replaced with the fresh one so this should resolve the problem with the NVIDIA GameStream, if not, refer to the other given options below.

Option 2 – Try updating the drivers from the official site of NVIDIA

If both the first and second given options didn’t work, you can also try updating the drivers from the official NVIDIA website. And in case you don’t know the type of Nvidia graphics card that your computer is on, follow the steps below:

• Tap the Win + R keys to open the Run dialog box.
• Next type in “dxdiag” in the field and click OK or hit Enter to open the DirectX Diagnostic Tool.
• From there, you can see what type of Nvidia graphics card that your system is on.
• Take note of your graphics card information and then look for the best drivers for your operating system. Once you’ve downloaded and installed the file, restart your PC.

Option 3 – Try to roll back the driver to the previous version

If updating the NVIDIA display drivers didn’t work for you, then it’s time to roll back the device drivers. It is most likely that after you updated your Windows computer that your driver also needs a refresh.

• Tap the Win + R keys to launch the Run window and then type in the “MSC” command and hit Enter to open the Device Manager window.
• Under the Device Manager, you will see a list of drivers. From there, look for the NVIDIA Drivers and expand it.
• Next, select the driver entries that are labeled appropriately.
• Then select each one of them and double click to open a new mini window.
• After that, make sure that you’re on the Driver tab and if you are not, just navigate to it then click the Roll Back Driver button to switch back to the previous version of the NVIDIA Drivers.
• Now restart your computer to successfully apply the changes made.

Option 4 – Try fixing your network

The next thing you can do to fix the problem with the NVIDIA GameStream is to fix the glitches in your network. Make sure that you connect both of your devices to a 5 GHz Wi-Fi network and you also have to ensure that the Wi-Fi connection you’re connected to is strong enough for both the devices for the latency to go down. Once you’ve covered all of these things with your network, restart your computer and change the Wi-Fi channel both devices are connected to. This should resolve the problem.

Option 5 – Try to update the NVIDIA SHIELD device

You might also want to update the NVIDIA SHIELD device. There are times when an outdated NVIDIA SHIELD device can result to several issues like the problem with the NVIDIA GameStream. Thus, you need to update NVIDIA SHIELD and check if it fixes the problem or not.

File Transfer Protocol Server, also known as FTP Server, is a private or public service that can host files that can be accessed both locally and globally. It is a quick, flexible and seamless service that allows you to store any kind of files depending on the total size of the server. If you’ve always found an FTP server useful, then the good thing is you can now create your FTP server since Windows 10 now allows it. You can host this server locally and later on make it globally available via the internet. So if you are planning to set up an FTP server on your Windows 10 computer, read on as this post will guide you on how to do so.

To set up the FTP server, you need to configure it first and then configure the Windows Firewall for the connections to go through. For more details, refer to the following steps:

Step 1: You need to configure the FTP server on Windows 10.

• In the Search box, type in “Turn Windows Features On or Off” to search for it.
• Then click on the appropriate result which will open a mini window.
• From this mini window, scroll down to the list and expand “Internet Information Services where you have to expand the FTP Server section.
• Next, select all the checkboxes to enable all the entries under FTP Server and then click the OK button to apply the changes made.
• And now, since your computer is now allowed to host an FTP server, you need to configure it. To do so, type “Internet Information Services (IIS) Manager” in the Search box and click on the appropriate entry.
• Next, right-click on Sites under the navigation bar of Connections and select Add FTP Site. This will open a new window where you have to input some information about your FTP hosting.
• Now enter the details and click on Next.
• Upon clicking Next, you will be prompted to give some authentication details. Enter the following details in the screenshot below.
• Now click on Finish. After that, you will get an FTP Server being hosted on your Windows 10 PC.

And now that you’ve successfully configured the FTP Server, the next thing you have to do is to allow connections from and to the FTP server. Refer to the next step below. Step 2: Configure the Windows Firewall for FTP connections to pass-through

• In the Start Search, type “Allow an app or feature through Windows Firewall” and click on the related search result which will open a window with all the settings.
• From there, click on the Change Settings button. This will display a list where you have to mark all the checkboxes for the FTP server to enable them in both the Private and Public configurations.
• After that, click OK. This will allow you access to the FTP server on your local network.

Microsoft office has set itself as one of the most used and best suites for business use and MS Word as the most widely used word processor. But how even best are not immune to some small bugs and unexpected behaviors so is not Word. Word has stopped working is probably know to a wide audience of its users, I think I could safely say that each Word user has experienced this error at least once, luckily the error is not anything to worry about since it is an easily fixable issue.

Try automated solutions

There are some fully automated solutions that could fix any PC issues, some are available in free versions. If you prefer to do things manually however keep on reading and follow the instructions below.

Manual FIXES:

1. Update MS Word

   Make sure that you are running the latest build of Word in order to eliminate all bugs and to have a smooth running experience. Go to File > Account > Product Information > Update Options and click Enable Update and then select Update Now.

2. Check the file

   Corrupted files can cause this crash and this error, try opening another text file inside the Word to eliminate file corruption.

3. Run Word in safe mode and disable add-ins

   Did you know that MS Word has a safe mode like Windows? In this safe mode, Word will boot up just the application without any add-ins installed and in this environment, you can start one add-in by one to see which one is causing the issue. Press ⊞ WINDOWS + R to open the run dialog Inside run dialog type in winword /safe followed by ENTER to run Word in safe mode If MS Word works fine in Safe mode, disable all COM Add-ins (while being in safe mode) and restart Word. Re-enable the add-ins one at a time to identify the problematic one. Click on File and then on Options Click on Add-Ins from the options list Select COM Add-ins from the drop-down menu and click on Go Uncheck all the add-ins and click OK to confirm Close the Dialog Box and MS Word. Now try running MS Word normally and see if it works Repeat steps to enable the add-ins, one at a time, and check which add-in is causing this error

4. Repair Word installation

   Press ⊞ WINDOWS + R to open the run dialog In run dialog type in control panel and press ENTER Inside Control Panel click on Programs and Features Locate and click on Microsoft Office to select it Once selected click on change located on top of the application list Once Office Windows loads click on Repair Wait for the process to finish

5. Reinstall MS office

   If all the previous solutions failed next step would be to completely uninstall MS Office and install it again once the old one has been completely removed from the system. Go to the control panel as explained in the previous step and select Office Instead of Change this time click on uninstall and follow on-screen instructions Once uninstall is finished, install a new copy of MS Office.

What is PyLocky ransomware? And how does it execute its attack?

PyLocky ransomware is a file-locking malware created in order to lock important files and demand ransom from victims in exchange for data recovery. This new ransomware uses the .lockymap extension in marking the files it encrypts. It starts to execute its attack by dropping the following malicious payload in the system:

Name: facture_4739149_08.26.2018.exe SHA256:8655f8599b0892d55efc13fea404b520858d01812251b1d25dcf0afb4684dce9 Size: 5.3 MB

After dropping its malicious payload, this crypto-malware connects the infected computer to a remote server where it downloads more malicious files and places them on system folders. It then applies a data gathering module used to gather data about the user and the computer. The malicious files that were downloaded earlier along with the data obtained are used for another module called stealth protection. This allows PyLocky ransomware to execute its attack without detection from any security or antivirus programs installed in the system. It also modifies some registry keys and entries in the Windows Registry such as:

• HKEY_CURRENT_USERControl PanelDesktop
• HKEY_USERS.DEFAULTControl PanelDesktop
• HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
• HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce

Once all the modifications are carried out, PyLocky ransomware will begin encrypting its targeted files using a sophisticated encryption cipher. Following the encryption, it adds the .lockymap extension to each one of the encrypted files and releases a ransom note named “LOCKY-README.txt” which contains the following content:

“Please be advised: All your files, pictures document and data has been encrypted with Military Grade Encryption RSA ABS-256. Your information is not lost. But Encrypted. In order for you to restore your files, you have to purchase a Decrypter. Follow these steps to restore your files. 1* Download the Tor Browser. ( Just type in google “Download Tor“ 2‘ Browse to URL: http://4wcgqlckaazungm.onion/index.php 3* Purchase the Decryptor to restore your files. It is very simple. If you don’t believe that we can restore your files, then you can restore 1 file of image format for free. Be aware the time is ticking. Price will be doubled every 96 hours so use it wisely. Your unique ID : CAUTION: Please do not try to modify or delete any encrypted file as it will be hard to restore it. SUPPORT: You can contact support to help decrypt your files for you. Click on support at http://4wcgqlckaazungm.onion/index.php”

How does PyLocky ransomware spread over the web?

PyLocky ransomware spreads using malicious spam email campaigns. Creators of this threat embed an infected attachment to spam emails and send them using a spambot. Crooks may even use deceptive tactics to trick you into opening the malware-laden immediately which is something you must not do. Thus, before opening any emails, make sure that you’ve thoroughly checked them. To successfully obliterate PyLocky ransomware from your computer, refer to the removal guide laid out below.

• Step 1: Launch the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
• Step 2: Under the Task Manager, go to the Processes tab and look for the process named facture_4739149_08.26.2018.exe and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to PyLocky ransomware.
• Step 3: After that, close the Task Manager.
• Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
• Step 5: Under the list of installed programs, look for PyLocky ransomware or anything similar, and then uninstall it.
• Step 6: Next, close the Control Panel and tap Win + E keys to launch File Explorer.
• Step 7: Navigate to the following locations below and look for PyLocky ransomware’s malicious components such as facture_4739149_08.26.2018.exe and LOCKY-README.txt as well as other suspicious files, then delete all of them.

%TEMP% %WINDIR%System32Tasks %APPDATA%MicrosoftWindowsTemplates %USERPROFILE%Downloads %USERPROFILE%Desktop

• Step 8: Close the File Explorer.
• Step 9: Tap Win + R to open Run and then type in Regedit in the field and tap enter to pull up Windows Registry.
• Step 10: Navigate to the following path:

HKEY_CURRENT_USERControl PanelDesktop HKEY_USERS.DEFAULTControl PanelDesktop HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce

• Step 11: Delete the registry keys and sub-keys created by PyLocky ransomware.
• Step 12: Close the Registry Editor and empty the Recycle Bin.

Try to recover your encrypted files using the Shadow Volume copies Restoring your encrypted files using Windows Previous Versions feature will only be effective if PyLocky ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot. To restore the encrypted file, right-click on it and select Properties, a new window will pop up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.