Logo

Fix UTCSVC high CPU and Disk usage in Windows

There is a lot of high resource utilization by any process that slows down a Windows operating system and one of the services that could cause such a thing is the utcsvc.exe process. This particular process at times can cause high CPU and disk usage. So if you are currently facing this problem, read on as this post will guide you on how you can resolve the problem.

UTC which stands for Universal Telemetry Client is a software that runs a service named Diagnostic Tracking Service or DiagTrak. This service is used by Microsoft to collect customer feedback, analyze customer’s problems, and push resolution via updates in order to make the Windows 10 operating system better. This service is an executable file that could be translated to Service Host and even though the process does not usually cause problems, there are actually times when it does especially if it results in high resource utilization. In such cases, you might want to consider disabling it to fix its high CPU and disk usage.

According to Microsoft:

“We collect information about you, your devices, applications and networks, and your use of those devices, applications, and networks. Examples of data we collect include your name, email address, preferences, and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage.”

There are several ways you can disable the utcsvc.exe process. You can disable it using the Service Manager, Registry Editor, and Group Policy Editor. For more details, refer to the instructions laid out below.

Option 1 – Disable the Connected User Experience & Telemetry Service via Service Manager

Note that this option is for standalone systems, so if you’re not using one, refer to the next given options below.

  • Tap the Win + R keys to open the Run dialog box.
  • Then type “services.msc” in the field and tap Enter or click OK to open the Services Manager.
  • From the given list of services, look for the Connected User Experience service. Once you found it, click on it and you’ll see its description which states:

“The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event-driven collection and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled under Feedback and Diagnostics.”

  • Next, right-click on it and select Properties.
  • Now, change its Startup Type to Disabled and click on the Apply and OK buttons to save the changes made.

Option 2 – Disable the Connected User Experience & Telemetry Service via Registry Editor

  • Tap the Win + R keys to launch the Run utility and type “Regedit” in the field and click OK to open the Registry Editor.
  • Next, navigate to this registry path: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsDataCollection
  • After that, right-click on the folder named “DataCollection” and select New > DWORD (32-bit) Value.
  • Now name the new value “AllowTelemetry” and make sure that its Value data is “0” and then click on OK to save the changes made.
  • Restart your computer.

Option 3 – Disable the Connected User Experience & Telemetry Service via Group Policy Editor

If you have to disable the service related to the Universal Telemetry Client for company-managed systems, then you can do that using the Group Policy Editor.

  • Tap the Win + R keys to open the Run utility and type “gpedit.msc” in the field and hit Enter to open the Group Policy Editor.
  • Next, navigate to this path: Computer Configuration > Administrative Templates > Windows Components> Data Collection and Preview Build
  • After that, double-click on Data Collection and Preview Build to open its settings.
  • From there, look for the “Allow Telemetry” item and double click on it to open its Properties.
  • Next, set the radio button to Disabled and then click on the Apply button to save the changes made.
  • Restart your computer.

Option 4 – Run the Hardware and Devices Troubleshooter or the Performance Troubleshooter

Hardware and Devices Troubleshooter:

  • The first thing you need to do is click on Start and then on the gear-like icon to pull up the window for Settings.
  • After opening Settings, look for the Update and Security option and select it.
  • From there, go to the Troubleshoot option located on the left-hand side of the list.
  • Next, select Hardware and Devices from the list and open the Troubleshooter and run it. Once it is doing its job, wait for it to complete the process and then restart the system.
  • After the system restarts, check if the problem’s now fixed. If not, refer to the next option given below.

Performance Troubleshooter:

  • Tap the Win + R keys to open the Run dialog box.
  • Type “exe /id PerformanceDiagnostic” in the field and hit Enter to open the Performance troubleshooter.
  • Then click on Next to get started. Wait until the process is completed.

Do You Need Help with Your Device?

Our Team of Experts May Help
Troubleshoot.Tech Experts are There for You!
Replace damaged files
Restore performance
Free disk space
Remove Malware
Protects WEB browser
Remove Viruses
Stop PC freezing
GET HELP
Troubleshoot.Tech experts work with all versions of Microsoft Windows including Windows 11, with Android, Mac, and more.

Share this article:

You might also like

Selected boot image did not authenticate Error
If you are using UEFI and you encountered an error message that says, “Selected boot image did not authenticate”, then read on as this post will show you what to do it fix it. This kind of error indicates that UEFI is having an issue in figuring out if the boot image has tampered with. UEFI offers Secure Boot and if the boot image seems to be invalid, you won’t be allowed to boot into your computer. Aside from that, it could be that you may be using endpoint encryption and the software can’t validate the certificate. To fix the “Selected boot image did not authenticate” error in UEFI, you need to first check if the error has given any reference to any software that you might have for encryption. If it has, then you need to disable the Encryption tool to resolve the problem. In addition, you could also try to disable Secure Boot or perform Startup Repair in case the disabling Encryption tool didn’t work. For more details, make sure to use each one of the options provided below as a reference.

Option 1 – Try to disable the Encryption tool

The first thing you can do to fix the “Selected boot image did not authenticate” error is to disable the Encryption tool. Many users reported that some encryption tools like the ESET Endpoint Encryption won’t let them boot into the computer if the system manufacturer does not include the correct certifications as a part of the UEFI BIOS. And since there is no way to bypass this, you have to disable Secure Boot in order for you to boot into your computer.

Option 2 – Disable the Secure Boot in the BIOS

Disabling the Secure Boot in the BIOS settings is definitely recommended to resolve the error. To disable Secure Boot, here’s what you have to do:
  • First, boot your computer into Windows 10.
  • Next, go to Settings > Windows Update. From there, check if there is anything that you have to download and install if you see any available updates. Usually, OEMs send and update the list of trusted hardware, drivers, and operating systems for your computer.
  • After that, go to the BIOS of your computer.
  • Then go to Settings > Update & Security > Advanced Startup options. If you click on Restart Now, it will restart your computer and give you all the advanced options.
  • Next, select Troubleshoot > Advanced Options. As you can see, this screen offers you further options including System restore, Startup repair, Go back to the previous version, Command Prompt, System Image Recovery, and UEFI Firmware Settings.
  • Select the UEFI Firmware Settings which will take you to the BIOS.
  • From there, go to the Security > Boot > Authentication tab where you should see Secure Boot. Note that every OEM has its own way of implementing the options so it varies.
  • Next, set Secure Boot to Disabled and set Legacy Support to On or Enabled.
  • Save the changes made and exit. Afterward, your computer will reboot.

Option 3 – Try to run the Automatic Repair Utility

If disabling Secure Boot did not fix the problem, you might also want to run the Automatic Repair utility in fixing the error. To do so, follow the steps below.
  • You can start by booting into the Advanced Recovery Mode.
  • After that, select Troubleshoot > Startup Repair.
  • Next, follow the on-screen instructions that appear on the screen and finish the Automatic Repair process.
  • Now check if the block is gone once the reboot is completed.
Read More
MS Mariner, new OS for servers based on Linux
mariner installerWell if anyone told me just a few years ago that I will see the day when Microsoft releases a new OS based on Linux I would be very amused, but that day has come. Mariner is the newest OS out of nowhere. Microsoft’s new Linux Distro, dubbed Common Base Linux (CBL)-Mariner, isn’t the type of distro you’d want to install directly on any old machine. It’s primarily meant for cloud infrastructure and edge products. Specifically Microsoft’s Cloud and Edge products. But if you are curious, it’s possible to run. Juan Manuel Rey, a Microsoft Senior Program Manager for Azure VMware, recently published a guide to ISO CBL-Mariner image. With that, you can easily get it up and running. And you can build CBL-Mariner on an Ubuntu 18.04 desktop. So you can try it out since it is free. You can get it from here: https://github.com/microsoft/CBL-Mariner It is obvious that Microsoft aims to set itself as a leader in enterprise server environments with this move and it is very likely that it may succeed or at least give a good shake to its competitors, mainly red hat and Suse which are two dominant distros in that field. Many believe that they can win over by providing regular updates and package delivery via their already established system and that feature could be a turning point for some. In any case, time will tell and we shall see.
Read More
0x80070780, The file cannot be accessed
Error 0x80070780 is a particularly nasty error since it means we can not access files on our hard drive. This might be an important file from work or anything similar and it can be frustrating when we can access it. In this article, we will address solutions to this error so you can continue with your activities where you have left off. Follow the guide step by step in the given order to minimize file damage and find the solution quickly.
  1. Run File and Folder built-in troubleshooter

    The simple and clean solution, try first by running Windows built-in tools. Leave troubleshooter to scan and attempt repairs and try to access a file after that.
  2. Run disk checker

    Maybe the file is corrupted or slightly damaged but repairable, run a built-in Windows disk checker and let it scan and repair any error found. Try accessing your file after the scan.
  3. Try copying file

    If the file is under a bad sector or cluster on a disk drive that could be a reason why you can not access it, try copying the file to another location and then opening it, if the operation fails, boot Windows in safe mode and try to copy or move file then. If you are successful with copying files in safe mode, reboot your computer and try to open the file.
  4. Reinstall the driver for the hard drive

    Like when the driver for USB is not working and you can not access files same can happen on your hard drive. Go to the device manager and reinstall the driver for your hard drive.
Read More
5 Common Windows 11 Issues You Can Solve Super Quickly

It really sucks when you can’t fully enjoy the newest version of your favorite OS.

Windows 11 is still relatively fresh and consequently has some annoying little bugs that really ruin our experience. The good news is that you’re not alone and most of them are easy to fix.

Here are 5 commonly reported Windows 11 issues and what you can do to get rid of them.

1. Windows 11 audio problems

One of the absolute most irritating things in the world is struggling with the sound on your computer. Windows 11 users have reported facing the issue of low or no sound. If you’re currently experiencing the same frustration, you can be relieved. Chances are fixing it will only take a few minutes.

The first thing to check would be whether you accidentally muted your device by pressing the mute button on your keyboard. Yes, we know it sounds a lot like the old “have you tried turning it off and on again?” But it’s important to leave no stone unturned, and the most obvious things are usually the ones we easily overlook.

Moreover, if you have several audio output sources, check whether the right one is selected. You can do this via the Action Center or through Settings. If you want to use the same source every time, we also recommend you set it as the default one.

It’s also important to have a good, up-to-date audio driver. More often than not, this will be the true cause of your audio struggles. Make sure to update your driver, and if that doesn’t work out, you can always un- and reinstall it or install a different one. 

Lastly, if all attempts remain unsuccessful, run the audio troubleshooter to figure out what’s actually going wrong.

2. Unable to find files

Such a powerful new operating system, yet it can’t seem to do the simplest thing imaginable? The File Explorer not responding on Windows 11 is one of the most frustrating and most common problems with Microsoft’s newest iteration of its awesome OS.

However, 9/10 times it can be fixed by simply restarting your PC. You could also try killing the Windows Explorer process in the Task Manager and then rerunning it.

If these don’t help, check whether there are any pending Windows 11 updates. A single missing update can compromise your PC’s functionality, so always make sure to install them all on time. 

Should none of that work, then there are other ways to solve the File Explorer problem. However, then the issue is probably a bit deeper and it’s no longer in the ‘easy fix’ territory.

3. Start menu not working

Just like the File Explorer, the Start menu is a fundamental element of your OS. So, it’s only natural that its malfunction grinds your gears. It may be more customizable than on previous Windows versions, but it doesn’t always work smoothly. 

If you’re facing the so-called Start menu critical error, there are a few things this could be caused by. Usually it means you turned off your system while an important update was still being installed, there is a corrupt file on your PC, or Windows forcefully stopped a program. 

Whatever the reason, the solution should be pretty simple. Try the basic steps: restarting your File Explorer (like we explained above) and signing out and back into your account. If that doesn’t do anything, you may want to try uninstalling third-party start menu apps (if you have any), since they can interfere with your default programs’ functionality.

Now, those are the easy fixes. If you get nowhere with them, you might need to identify the root cause and search for more complex solutions than that.

4. Snipping tool not working

Our beloved screenshot tool was introduced with Windows 10 and Microsoft decided to keep it. However, you were probably just as disappointed as us when you tried to run it and failed. 

Normally, this can be fixed by installing the latest Out-of-band (OOB) update, or even pending updates in general. Even if your system appears to be up-to-date, run the checker just in case.

Another cool thing Windows 11 lets you do is ‘Repair’ and ‘Reset’, which is the easiest way to troubleshoot your Snipping tool. If this fails, you can also try the good old un- and reinstall method. Simply uninstall the tool through the Control Panel and reinstall it from the Microsoft Store.

Furthermore, in the case of an upgrade from Windows 10 to 11, it may be that the old Snipping tool version is interfering with the launch of the new one. If you don’t care that much about the additional options available with the enhanced screenshot tool, you can use the old version instead.

Simply go to your C Drive, find the Windows.old folder, search for the tool and open it from there. Make sure to pin it to your taskbar as well, if you know you’re going to use it often.

5. Can’t install the latest update

The latest Windows 11 version, 22H2, has brought tons of enhancements to our dearest operating system. Unfortunately, a lot of users still haven’t had the opportunity to experience it. A mere update of your OS version should be the one thing that goes smoothly, but sometimes that’s not the case.

Failure to install 22H2 can be caused by a few things. Most commonly, the issue is caused by lack of storage space or corrupted files, but there could be other culprits.

There are a couple of things you could try. For example, it’s crucial that your drivers be up-to-date and some important services be enabled. These are: Windows Modules Installer, Background Intelligent Transfer Service, Cryptographic Service, Windows Update services.

To enable them, search ‘Services’, find the service you need and right-click on it. Open ‘Properties’ and select the startup type ‘Automatic’.

It may also be necessary to unplug all peripherals that aren’t crucial and disable third-party antivirus tools until after the update is finished. 

Ultimately, you can run the Windows Update troubleshooter to detect and fix other possible issues.

Summary

Tiny bugs like these are nothing out of the ordinary. That said, we still all hate when they happen.

Hopefully some of our solutions have helped you to a smoother Windows 11 experience. But if you’re still struggling, feel free to reach out to us. We’d be happy to help!

Read More
Fix intelppm.sys error in Windows 10
intelppm.sys blue screen of death is linked to an outdated driver, if you received this error do not sweat we have simple solutions for you. Please keep on reading in order to find out what can you do to fix this error.
  1. Update driver Go to the device manager and manually update old-dated drivers. Note that this will take some time because you will need to update each device manually through the device manager but in the end, it will fix the issue.
  2. Use automated application Instead of going through each device one by one manually get a dedicated driver fixing device like DRIVERFIX and update all drivers automatically.
Read More
Perform System Restore when Windows won’t boot
System restore is usually the go-to tool when something goes bad in Windows, we fire it up and roll back Windows in the state when everything was working fine. But what if Windows does not want to boot? Can we use system restore in that case? The answer to that question would be yes, yes we can.
  1. Boot interrupt Windows 10 by starting your PC and as soon as you see the Windows logo; press and hold the power button to force a shutdown.
  2. Repeat this 2-4 times and Windows will open up the Advanced Startup Options menu for you.
  3. At the Advanced Startup Options screen, select Advanced Options.
  4. Select Troubleshoot.
  5. Under the Advanced options screen, select System Restore.
or if you prefer, use Windows USB installation.
  1. Boot the faulty PC using the Windows 10 installation media.
  2. The Windows Setup dialog box will appear.
  3. Set the Time and currency format, Keyboard or input method, and the language to install.
  4. Click Next.
  5. Click on Repair your computer from the lower-left corner.
  6. From the Choose an option screen, click on Troubleshoot.
  7. Click Advanced Options in the Troubleshoot screen.
  8. In the Advanced Options screen, click System Restore.
  9. Windows will take some time to prepare System Restore. It may even restart your computer or device.
  10. When System Restore is ready, you will be prompted to choose a user account to continue.
  11. Select an account that is set as administrator on your Windows 10 computer or device.
  12. At the next screen, change the keyboard layout if you want and then input the password for that account.
  13. Click the Continue button.
Read More
Fix 0x8000ffff error in Windows 11
Error 0x8000ffff prevents you from using the Microsoft store. Altho it is not a critical error that will break Windows, it is annoying enough that will require fixing so we can use the store once again and install apps when we want to. Interesting thing is that this error was present inside Windows 10 as well causing some annoyance, you think Microsoft would learn, and then you see reality. Anyway, we have not come here to bash Microsoft, we came to solve errors. 0x8000ffff errorSo there are several problems that can cause this error like issues with accessing the Microsoft servers, corrupt system files, settings being misconfigured, malware infections, or conflicting applications. We will cover all solutions for each scenario taking approaches from most simple solutions to more complex ones. Follow the guide and let's fix this annoyance.

Wait for Microsoft's servers to become accessible

Yes, just wait. If the problem is tied to Microsoft servers having heavy load or being temporarily down there is not much you can do except for their tech team to resolve the issue. Go to Twitter or Facebook and check the Microsoft page to see if anyone else has this issue, if several people are reporting the same error then it is due to server problems. In this case, the only thing you can do is to wait.

Run troubleshooter

If servers are working fine then the issue is within your system so let's get down to fixing. Most simple and easiest solution is to let Windows try and resolve the problem by itself. We will use troubleshooter for this, Windows's integrated fixing solution: Press ⊞ WINDOWS + I to open the settings app Click on System in the left panel, then on Troubleshoot on the right Click on Other troubleshooters In most Frequent section find Windows Update and click on the Run button Wait for the troubleshooter to finish and follow on-screen instructions

Clear Store cache

If the troubleshooter has not found the issue or was unable to repair it, the next step is cleaning the Microsoft store cache in order to eliminate corrupted or partial cache files. Press ⊞ WINDOWS + R to open the run dialog In run dialog type in: wsreset and press OK or press ENTER A black screen will appear and it will not give any kind of feedback about progress, so it might seem like Windows has frozen, but do not panic nor try to do anything, this kind of behavior is normal, just wait for the process to finish and once it is done Microsoft store will launch with the cleared cache.

Disable Proxy

Proxy setting can interfere with establishing a connection to the store servers and if previous solutions have not worked we will check proxy next. Press ⊞ WINDOWS + R to open the run dialog Inside run dialog type: inetcpl.cpl and hit ENTER or press OK button Inside Internet Properties click on the Connections tab and then on LAN settings Uncheck the box next to Use a proxy server for your LAN and click on OK

Turn off antivirus

If nothing worked so far, turn off your anti-virus software, there is a slight possibility that your antivirus is misconfigured or preventing the system from accessing the store. Turn off antivirus and firewall to make sure that this is not an issue.

Delete the software distribution folder

So, we have tried a lot of things, and the error still persists? Let's then go to the next step and delete the software distribution folder in order to be remade new so we can eliminate corruption in the folder itself. To do this follow the guide: Press ⊞ WINDOWS + S to open the search menu Inside search type in Windows terminal, right-click on the terminal and click on Run as administrator. Confirm with YES on UAC prompt pop up Inside terminal press CTRL + SHIFT + 2 to open command prompt inside command prompt type in: net stop wuauserv and press ENTER Then type in: net stop bits followed with ENTER Next press ⊞ WINDOWS + R to open the run dialog Inside run dialog type in C:\Windows\SoftwareDistribution and press the OK button or ENTER File Explorer will open and you will find yourself inside SoftwareDistribution folder. Press CTRL + A to select all files inside Press on the delete icon or press DEL, confirm with YES Once all files are deleted, the system will redownload new ones.

Enable Cryptographic service

Windows 11 has come with a cryptographic service that aims to make your computer more secure but if the service is turned off it can be the cause of 0x8000ffff error. In order to turn this service back ON, follow the guide: Press ⊞ WINDOWS + R to open the run dialog In run dialog type in services.msc and press ENTER or click on the OK button In the list find Cryptographic Services and double click on it Inside properties click on Startup type dropdown menu and select Automatic from the list Click on the Start button to run service and then on the OK button to save the changes

Run SFC scan

SFC is an internal Windows tool for fixing corrupt system files, application will scan all system files and repair ones that are corrupted. To run an SFC scan do the following: Press ⊞ WINDOWS + S to open the search menu Inside search type in Windows terminal, right-click on the terminal and click on Run as administrator. Confirm with YES on UAC prompt pop up Inside terminal press CTRL + SHIFT + 2 to open command prompt inside command prompt type in: SFC /scannow and press ENTER Wait for the whole process to finish and reboot your system

Run DISM scan

Similar to SFC, DISM scan will scan your system Windows image and if required it will repair it. Press ⊞ WINDOWS + S to open the search menu Inside search type in Windows terminal, right-click on the terminal and click on Run as administrator. Confirm with YES on UAC prompt pop up Inside terminal press CTRL + SHIFT + 2 to open command prompt inside command prompt type in: DISM /Online /Cleanup-Image /RestoreHealth and press ENTER Wait for the whole process to finish and restart your computer
Read More
Quick Solution Guide to Error Code 40

Error Code 40 – What is it?

Error Code 40 is a device driver error that users encounter on any Windows 2000 and later operating systems. It occurs when the peripheral device that you connect to your PC cannot be accessed due to a change in the system registry.

This is due to the presence of invalid sub-keys of the device driver in the system registry. It is a common error that users come across and appears on your PC with either of the following messages:

“Information in the registry entry for this driver is invalid”

OR

"Windows cannot access this hardware because its service key information in the registry is missing or recorded incorrectly. (Code 40)"

Solution

driverfix boxError Causes

As mentioned above, the error code is triggered when the device driver’s invalid sub-keys appear in the registry, effectively changing it. This happens when the windows system files get damaged due to the following factors:

  • An incomplete program uninstallation
  • An incomplete program installation
  • Hardware is not removed properly
  • System recovery from viruses
  • An improper system shut down

Factors such as incomplete installations or uninstallations or an improper system shut down can cause files to become damaged that threaten the health of your computer.

Removing viruses from the computer is also another factor as it removes the entries in the Windows system files which contain the viruses including spyware or malware

Further Information and Manual Repair

Fixing Error Code 40 is similar to fixing other device manager error codes. Here are a few methods you can try.

Method 1 – Use System Restore

You can use system restore to eliminate the problem. Here is how you can use it:

  • Log in using an Administrator account
  • Click ‘Start’ button and select All Programs > Accessories > System Tools > System Restore
  • Click ‘Restore my computer to an earlier time’ and click ‘Next’
  • Select the last Windows restore point from the ‘On this list, click a restore point’ list, and click ‘Next’
  • Click ‘Next’ on the confirmation window to proceed
  • Restart your PC after restoration is complete
By restoring the system via a last saved system checkpoint, you can obtain undamaged Windows system registry files that can help avert the error code.

Method 2 – Manually uninstall then reinstall the device driver

If using system restore also does not work in removing the error code, you may have to resort to manually uninstalling and then reinstalling the device driver causing the problem.

This would be necessary since the remaining incomplete files due to a partial removal or installation of programs is what contributes to the error code. By uninstall and reinstalling the device driver program, it would lead to the completion of the files.

You can do this by firstly logging in as Administrator and open Device Manager. Select the device that is causing the problem and double click it and make sure that the peripheral is connected properly to the PC. Upon opening, click on the ‘Driver’ tab and then select ‘Update Driver’.

Make sure to refer to the system documentation that you received with your PC or computer to check for the motherboard details and driver specifics.

Method 3 – Use software to automatically download the driver

Manually uninstalling and reinstalling the driver will do the trick, however, it may be time-consuming especially when you would have to resort to your hardware user manual.

Therefore, using a program such as DriverFIX can save you a lot of time and frustration in having your device work properly on your computer.

DriverFIX, with its user-friendly approach to help you fix your PC issues, comes with an integrated database that detects which drivers you need to reconfigure within just a few seconds and downloads it automatically.

It further ensures that your drivers are installed in their entirety leaving no room for any incomplete files to remain that create Error Code 40.

It also has the added advantage of being able to backup and restores your files should there be the slightest possibility of system file damage.

Thus, registry damage can be averted by letting the software roll back the system files to an earlier healthy checkpoint. Driver Assist is the answer to fixing your PC error codes accurately and quickly.

Click here to download DriverFIX to fix Error Code 40 quickly and effectively!
Read More
How to Obliterate PyLocky Ransomware

What is PyLocky ransomware? And how does it execute its attack?

PyLocky ransomware is a file-locking malware created in order to lock important files and demand ransom from victims in exchange for data recovery. This new ransomware uses the .lockymap extension in marking the files it encrypts. It starts to execute its attack by dropping the following malicious payload in the system:
Name: facture_4739149_08.26.2018.exe SHA256:8655f8599b0892d55efc13fea404b520858d01812251b1d25dcf0afb4684dce9 Size: 5.3 MB
After dropping its malicious payload, this crypto-malware connects the infected computer to a remote server where it downloads more malicious files and places them on system folders. It then applies a data gathering module used to gather data about the user and the computer. The malicious files that were downloaded earlier along with the data obtained are used for another module called stealth protection. This allows PyLocky ransomware to execute its attack without detection from any security or antivirus programs installed in the system. It also modifies some registry keys and entries in the Windows Registry such as:
  • HKEY_CURRENT_USERControl PanelDesktop
  • HKEY_USERS.DEFAULTControl PanelDesktop
  • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
  • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
Once all the modifications are carried out, PyLocky ransomware will begin encrypting its targeted files using a sophisticated encryption cipher. Following the encryption, it adds the .lockymap extension to each one of the encrypted files and releases a ransom note named “LOCKY-README.txt” which contains the following content:
“Please be advised: All your files, pictures document and data has been encrypted with Military Grade Encryption RSA ABS-256. Your information is not lost. But Encrypted. In order for you to restore your files, you have to purchase a Decrypter. Follow these steps to restore your files. 1* Download the Tor Browser. ( Just type in google “Download Tor“ 2‘ Browse to URL: http://4wcgqlckaazungm.onion/index.php 3* Purchase the Decryptor to restore your files. It is very simple. If you don’t believe that we can restore your files, then you can restore 1 file of image format for free. Be aware the time is ticking. Price will be doubled every 96 hours so use it wisely. Your unique ID : CAUTION: Please do not try to modify or delete any encrypted file as it will be hard to restore it. SUPPORT: You can contact support to help decrypt your files for you. Click on support at http://4wcgqlckaazungm.onion/index.php”

How does PyLocky ransomware spread over the web?

PyLocky ransomware spreads using malicious spam email campaigns. Creators of this threat embed an infected attachment to spam emails and send them using a spambot. Crooks may even use deceptive tactics to trick you into opening the malware-laden immediately which is something you must not do. Thus, before opening any emails, make sure that you’ve thoroughly checked them. To successfully obliterate PyLocky ransomware from your computer, refer to the removal guide laid out below.
  • Step 1: Launch the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
  • Step 2: Under the Task Manager, go to the Processes tab and look for the process named facture_4739149_08.26.2018.exe and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to PyLocky ransomware.
  • Step 3: After that, close the Task Manager.
  • Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
  • Step 5: Under the list of installed programs, look for PyLocky ransomware or anything similar, and then uninstall it.
  • Step 6: Next, close the Control Panel and tap Win + E keys to launch File Explorer.
  • Step 7: Navigate to the following locations below and look for PyLocky ransomware’s malicious components such as facture_4739149_08.26.2018.exe and LOCKY-README.txt as well as other suspicious files, then delete all of them.
%TEMP% %WINDIR%System32Tasks %APPDATA%MicrosoftWindowsTemplates %USERPROFILE%Downloads %USERPROFILE%Desktop
  • Step 8: Close the File Explorer.
  • Step 9: Tap Win + R to open Run and then type in Regedit in the field and tap enter to pull up Windows Registry.
  • Step 10: Navigate to the following path:
HKEY_CURRENT_USERControl PanelDesktop HKEY_USERS.DEFAULTControl PanelDesktop HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
  • Step 11: Delete the registry keys and sub-keys created by PyLocky ransomware.
  • Step 12: Close the Registry Editor and empty the Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies Restoring your encrypted files using Windows Previous Versions feature will only be effective if PyLocky ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot. To restore the encrypted file, right-click on it and select Properties, a new window will pop up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.
Read More
What to do if JPEG files won’t open in Windows 10
As you know, “JPEG” is one of the commonly used formats for image files which is a compression of digital images. It is one of the topmost used file formats by mobile phones and digital cameras and usually achieves a 10:1 compression with little visible loss in the quality of the image. There are tons of cases as of late, most particularly after the latest Windows 10 update where users were not able to open JPEG files on their PCs. Every time they try to open any JPEG file, they either get an error or nothing happens at all. This issue could be due to the default handler application for JPEG applications not being set or there could be some third-party image viewer not working properly. To fix this issue with JPEG files, refer to the troubleshooting options below.

Option 1 – Try to change the file type association

You need to check if the file type association of the JPEG files are correctly set or not since there are tons of third party programs that change the file type association automatically to themselves without your permission the instant they are installed and so if any of these third-party programs are broken, then naturally, your JPEG files won’t really open. That’s why you can try changing the setting to the default photo viewer instead of the third-party one. To do so, follow the steps below.
  • Tap the Win + R keys to open the Run dialog box.
  • Then type in “control panel” in the field and hit Enter to open the Control Panel.
  • After opening Control Panel, click on the Programs category and select the “Default Programs” option from the menu.
  • Next, select the second option “Associate a file type or protocol with a program” and then select the “Choose default apps by file type” option.
  • After that, click on the .jpg file extension and choose the option from the pop-up.
  • Now restart your PC to refresh all your programs and then see if it has fixed the problem or not.

Option 2 – Try to update your computer

Microsoft frequently releases updates to target bugs and improve users’ experience. And this particular error where JPEG files won’t open is already acknowledged by Microsoft so you need to make sure that your Windows 10 PC is updated to the latest released update and that there are no pending updates.
  • Tap the Win + S keys to open Search and then type in “update” in the field and open the system setting from the search results.
  • After that, check for updates and then download and install them if needed.
  • Now restart your PC once the update is done and check if you can now open JPEG files.

Option 3 – Try to reset the Photos app via Settings

Resetting the Photos app could also help you in fixing the problem. Note that this option will reset all the configurations and your data associated with your Photos and makes the application go into a state when you first started using it and that this option will fix any discrepancies that your application might be experiencing right now.
  • Tap the Win + S keys to open the search bar.
  • Then type in “settings” in the field to open the Settings application.
  • After opening Settings, click the “Apps” category.
  • From there, a list of applications installed on your computer will appear.
  • Navigate through these applications until you find the Photos app and then click on the Advanced options.
  • Afterward, click the Reset button that appears on the next screen. Then a new pop-up comes up and will warn you that all the preferences, as well as sign-in information, will be lost. Click on “Reset” anyway to proceed in resetting the Photos app.
  • Restart your PC once the reset is done.

Option 4 – Try to reinstall the Photos app

Before you start using other third-party image viewers just yet, you can try to reinstall the Photos app first. Thus, if there is something wrong with it, it will instantly get fixed right after it reinstalls. Just take note that this option requires administrative privileges so you need to be logged in as an administrator.
  • The first thing you have to do is tap the Windows + S keys and type in “PowerShell”.
  • Next, right-click on the file and click on the “Run as administrator” option from the context menu.
  • Once PowerShell is opened, execute this command: get-appxpackage *Microsoft.Windows.Photos* | remove-appxpackage
  • The command you just entered will remove the Photos app. After the process is done, go to the Microsoft Store and look for Microsoft Photos then download and install it again.
Read More
1 2 3 171
Logo
Copyright © 2023, ErrorTools. All Rights Reserved
Trademark: Microsoft Windows logos are registered trademarks of Microsoft. Disclaimer: ErrorTools.com is not affiliated with Microsoft, nor claims direct affiliation.
The information on this page is provided for information purposes only.
DMCA.com Protection Status