Fix the "Virus Scan Failed" download error in Google Chrome, and the "Couldn't Download Virus Scan Failed" error in Microsoft Edge

1. Locate the following registry subkeys:
   \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments
2. If you do not see the "Attachments" subkey, create it by right-clicking on "Policies", selecting "New", then clicking "Key", and then typing "Attachments" as the key name.
3. Right-click "Attachments", select "New", and then click "DWORD (32-bit) Value".
4. Type "ScanWithAntiVirus" as the value name, and then press Enter.
5. Right-click the new "ScanWithAntiVirus" DWORD value, and then click "Modify".
6. In the "Value data" box, type 1, and then click OK.
7. Exit the Registry Editor.
8. Restart your computer, and then log back into Windows to have the registry change take effect!

The download error(s) should be now resolved in both Google Chrome and Microsft Edge!

Jon Pienkowski
Pacific Northwest Computers
www.pnwcomputers.com
www.linktr.ee/pnwcomputers
360-624-7379

How can I keep my computer from getting infected? Pacific NW Computers' PC Security Tips

1. Make sure you regularly run MANUAL scans with your installed security software!

Security Programs We Recommend (Or Have Installed):

• Avast Antivirus, BitDefender Free, Microsoft Security Essentials
• MalwareBytes Anti-Malware
• Spybot Search & Destroy
• CCleaner

*For direct download links to the software listed above, visit "Pacific NorthWest Computers' Links and Recommended Software" page on our Blog Link below!
http://pnwcomputers.blogspot.com/2013/06/pnw-computers-links-and-recommended.html

Basic/General Scanning Procedure:

• Before running any scans with any of the installed security software, be sure to FULLY update the software FIRST.
• After updating the security software, perform the deepest and most thorough scan that the software is capable of. This is usually labeled as a FULL or COMPLETE scan.
• DELETE or QUARANTINE any and all of the security software’s findings.
• Make sure you DON’T download and install any scanner/security software that solicits you to download and install its software. These scanners are blacklisted because of their questionable reputation.

2. Make sure your Windows is ALWAYS up to date!

• An unpatched Windows is vulnerable and even with the “best” Antivirus installed; malware will find its way through.
  So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.
• Be sure to download and install all CRITICAL and SOFTWARE updates! You also may have to do several “passes” of Windows updates before all the available updates/patches are actually installed.
• Verify that your version of Windows Vista, Windows 7 or Windows 8 has the most recent service pack installed. If this is not currently installed on your system, the Windows Update website will recognize this vulnerability and request you to download and install any available Service Packs and other needed updats.

3. Stay away from questionable sites.

• This is one of the main causes why a computer gets infected. Visiting cracksites/warezsites – and other questionable/illegal sites is ALWAYS a risk. Even a single click on the site can be responsible for installing a huge amount of malware. Don’t think: “I have a good Antivirus and Firewall installed, they will protect me” – because that’s not true… there is no “Magic Bullet”. Before you know it, your Antivirus and Firewall may already be disabled because malware already found its way on your system.

4. Be careful with email attachments!

• Malware spreads via email as well, especially email attachments. The most common ones are emails telling you that your computer is infected and that you can find the removal tool in the attachment, emails telling you that your password has changed and can find it in the attachment, emails with product codes in the attachment from software that you purchased (which you didn’t), emails with attachments that are so called “Security Updates”, etc. etc.
• Don’t trust any emails like the ones listed above. Don’t even attempt to preview/open them and delete them immediately instead! It may also happen you receive an email from someone you know, but with a questionable attachment present and strange content in the e-mail’s message. In this case, this person – or someone else who has your address book in his/her address book – is infected with malware (worm/spambot) and sends these emails without being aware of it.
• Don’t click links in emails from someone you don’t know, because these links can redirect you to sites where malware gets downloaded and installed.

5. When surfing the internet…

• Use Google Chrome or the FireFox web browser as your MAIN internet browser. These browsers does not use ActiveX controllers or BHO’s (these are programs that are a standard feature’s of Microsoft’s Internet Explorer and are “exploited” vulnerabilities that hackers use to infect computers). If a specific website (such as a financial institution website) may require Internet Explorer to be used in order for you to view their site, then use Internet Explorer. But for that specific website ONLY!
• Don’t click on links inside pop-ups. ALWAYS close the windows via the "X" for the window vs. clicking "Cancel" or any other 'escapes' in the pop-up.
• Download software off of the internet from websites you know and trust. A lot of free software comes bundled with other software, including malware.
• Be careful when you are viewing videos online. Especially when you get a pop-up asking you to download a “Codec” to be able to watch the video. By default, your media player should already have the necessary codec installed to watch online videos. In the case that you’re prompted to install an additional codec while trying to watch a move online (or downloaded), it is most likely a false alert and this so-called codec may install malware.
• Don’t install plug-ins (ActiveX) if you’re not certain what it is or why it is you need it. (Unless you are attempting to perform Windows/Microsoft Updates).
• Glubble is a great FireFox add-on if you want to manage the sites your kids are allowed to see.

6. Watch what you download!

• If you want to install certain software, always go to the developer’s site to download the software. Then you can be sure you’re downloading and installing the right software. Be aware of the fact that certain software (especially freeware) may contain/come bundled with extra software including spyware and/or adware. So only install when you’re sure they are OK.
• The use of Torrent sites, Game Patches and Mods, Emulators; really anything "Free" is always a risk. Unless the download/host site is a reputable site, you can never be sure what you are exactly downloading. A file you are looking to download or have downloaded isn’t always what it’s made out to be.

If you have any questions or comments please don't hesitate to get in touch!

Jon Pienkowski
Pacific NorthWest Computers
www.pnwcomputers.com
360-624-7379

Microsoft Internet Explorer Vulnerability ~ Fact and Opinion

As you have most likely heard, Microsoft is scrambling to fix a major bug which allows hackers to exploit flaws in Internet Explorer 6, 7, 8, 9, 10 and 11. The company has also confirmed it will not issue a fix for web browsers running on Windows XP after it formally ended support for the 13 year old operating system back on April 8th.

The vulnerability was discovered by cyber security software maker FireEye Inc. which stated the flaw is a ‘zero-day’ threat. This means the first attacks were made on the vulnerability before Microsoft was aware of it. FireEye also revealed a sophisticated hacker group has already been exploiting the flaw in a campaign dubbed ‘Operation Clandestine Fox’, which targets US military and financial institutions.

FireEye spokesman Vitor De Souza declined to name the hackers or potential victims as the investigation is ongoing, only telling Reuters: “It’s unclear what the motives of this attack group are at this point. It appears to be broad-spectrum intel gathering.”

For its part Microsoft has confirmed the existence of the flaw in an official post: https://technet.microsoft.com/library/security/2963983

Now, Internet Explorer has always been a vulnerable browser and has exploits created/identified against it everyday. This is why for YEARS I have pushed my customers to use an alternative Web Browser such as Mozilla Firefox or Google Chrome. As previously mentioned, both of those web browsers are safer to use than Internet Explorer and are both immune from the recently identified exploit!

What makes this recent vulnerability stand out from the others, and why this particular vulnerability is making all the headlines, is that the problem is pretty widespread; affecting 1 in 4 Windows based computers and ALL Windows XP systems.

A Temporary Fix
While Microsoft rushes to fix the bug, FireEye gave concerned users two workarounds .

1. Use another web browser other than Internet Explorer
2. Disable Adobe Flash. “The attack will not work without Adobe Flash,” it said. “Disabling the Flash plugin within IE will prevent the exploit from functioning.”

*Adobe has released a new patch/update for their Flash Player! Allow the Flash Player to update or manually download and install the latest version here: http://www.adobe.com/support/flashplayer/downloads.html

No Hope For Windows XP
Microsoft has confirmed that no fix will be rolled out for Windows XP because support has officially ended and there are no plans to make an exception. It states:

“An unsupported version of Windows will no longer receive software updates from Windows Update. These include security updates that can help protect your PC from harmful viruses, spyware, and other malicious software, which can steal your personal information.”

The company’s advice to Windows XP users has remained the same for some time: upgrade to Windows 7 or 8 or buy a new PC. It has also repeatedly sent a pop-up dialog box to reachable Windows XP machines with the following end of support notification.

For users unsure whether their existing XP PCs can support Windows 8, Microsoft offers a software tool called ‘Windows Upgrade Assistant’ which can be downloaded here: http://go.microsoft.com/fwlink/p/?LinkId=321548

If you have any questions or concerns please don't hesitate to get in touch!

Jon Pienkowski
Pacific NorthWest Computers
www.pnwcomputers.com
360-624-7379

New Virus Alert: CryptoLocker!

A New Virus Has Surfaced ~ CryptoLocker

CryptoLocker is a new, nasty piece of malicious software that is infecting computers around the world; encrypting important files and demanding a ransom to unlock them. If you get hit with this virus you risk having your personal data encrypted and lost for good!

This sophisticated malware is delivered the old-fashioned way – an executable file hidden inside an attachment that looks like an ordinary ZIP file or PDF. One small business reports being compromised after clicking on an email attachment that was designed to look like a shipping invoice from the U.S. Postal Service.

The CryptoLocker virus can be removed from an infected system, but unfortunately at this time there is no way to retrieve the private key that can be used to decrypt your files without paying the ransom. Brute forcing the decryption key is not realistic due to the length of time required to break the key. Also any decryption tools that have been released by various companies will not work with this infection. The only method you have of restoring your files is from a backup or Shadow Volume Copies if you have System Restore enabled. Newer variants of CryptoLocker attempt to delete the Shadow Copies, but it is not always successful.

Preventive Measures:

1. BACKUP ALL OF YOUR DATA ASAP! That’s the only way to reduce the risk of losing your files forever. Also, to avoid getting your backup's encrypted your backup device should be disconnected from your computer until the next time you need to access it or run a backup. 
2. Download and install a free utility called 'Crypto Prevent'. Crypto Prevent is a small utility that changes a few settings in your computer to help prevent the CryptoLocker infection from happening in the first place! Its not a golden bullet however, so having current data backups is your ulitimate defense. You can downloading the Crypto Prevent utility directly from the link below!

http://www.foolishit.com/vb6-projects/cryptoprevent/

If you need any assistance we can setup a visit to help secure and backup your computer for you!

Let us know if you have any questions or issues!

Jon Pienkowski
Pacific NorthWest Computers
www.pnwcomputers.com
360-624-7379

Browser Redirect Virus Fix! Search Conduit, DefaultTab, MyWay Web Search, Etc.

The majority of computers coming in with virus infections all have browser hi-jacks and other browser-related malware infections. A browser hijacker is something installed onto a computer system and attaches to an internet browser to change internet browser settings; such as the home page and default search engine. This causes the now infected internet browsers to start up using their search bar or their search engine OR even just redirect you to where they want you to go. This type of infection can generate browser pop-ups while you’re surfing the internet, slow the computer's overall performance as well as lead to further and more severe virus and infection issues!

As with a vast MAJORITY of BHO's (browser helper objects such as toolbars), most use unethical practices and are utilized by ethical and unethical third parties, including cybercriminals and scam artists, to generate revenue through sites tied they are working for/partnered with as well as other third-party domains and advertising based search services.

Products and software associated with the browser redirection infections:

• Activeris AntiMalware
• Ado System Protect
• AnyProtect
• Any Send
• AssetsManager
• Babylon Toolbar
• BFlix Toolbar and TheBFlix
• BlockandSurf
• Boost Shopping
• Browser Guard
• Browser Protector
• BrowserRedirector
• Bubble Sound
• Chromium (Dregal)
• CinemaPlus vX.X
• Conduit
• Consumer Input Firefox Extension
• Coupoon (two 'oo')
• CrossBrowse
• DefaultTab
• Delta Toolbar
• Dregal (Chromium)
• Driver Pro
• Driver Restore
• Driver Updater (No Publisher/Specifics)
• File Type Assistant
• FLV Runner Toolbar
• Free Ride Games Player
• Games Desktop vX.X
• GeniusBox
• HashBrat
• IdleCrawler
• IE Web Protect
• IE Web Protect Plus
• Linkey
• Linksicle
• MapsGalaxy Toolbar (and other random/various related 'MapGalaxy' products)
• MediaPlayerEnhance
• MixiDJ  
• Mobogenie
• MyPC Backup
• MyWayWeb Search Toolbar
• NewPlayer
• Optimizer Pro vx.x
• OneSoftPerDay
• Pasta Leads
• PC Fix Speed vx.x.x
• Plus-HD-x.x
• PC Optimizer Pro
• PC Pro Cleaner
• Powerful Browse
• QuickRef
• Remote Desktop Access (No Publisher/Specifics)
• Search Conduit
• Search Protect
• Search Results LLC
• Shop To win
• Shopper Pro
• Shoperz
• SmartWeb
• Software Updater (No Publisher/Specifics)
• Software Version Updater (No Publisher/Specifics)
• Special Savings
• Unico Browser
• Wajam
• Web Companion
• WebProtector
• Web Protect for Windows
• WiseCare 365
• Yontoo
• Yontoo Layers
• YTDownloader

Removal Process:
1st Step
Uninstall all programs listed (and any others "odd" programs that have a similar install date) through "Programs and Features" aka "Add/Remove Programs" found through your computer's control panel.

2nd Step
Download and install MalwareByte’s Antimalware and Spybot Search and Destroy (1.6.2) to use in conjunction with your antivirus to run full virus scans on your computer! Remove (or at least quarantine) anything that the programs identify!
*If you don't have a current anti-virus we recommend one of the following AntiVirus titles; Microsoft Security Essentials, Avast! Antivirus or Bitdefender Free.

3rd Step
In all of your web browsers (Internet Explorer, Firefox, Chrome, etc) you want to examine all installed add-ons and extensions. Remove anything that is related to the software programs listed above. Additionally, you can use ADWCleaner and JRT to get even further "under the hood" to make sure all of your web browsers are clean from Adware and Browser Hi-Jack software.

4th Step (EXTRA)
Download and run TDSKiller from Kaspersky Labs to check your systems for any types of rootkit infections.

For direct download links to the software listed above, visit "Pacific NorthWest Computers' Links and Recommended Software" blog post:
http://pnwcomputers.blogspot.com/2013/06/pnw-computers-links-and-recommended.html

Further Reading/Related Articles:

How you can get infected & what you can do to try to prevent it:

https://pnwcomputers.blogspot.com/2024/07/how-am-i-getting-infected.html

How to do a full system clean-up with virus/malware scans:

https://pnwcomputers.blogspot.com/2024/07/how-to-do-tune-upclean-up-with-virus.html

Think someone is accessing your accounts and/or devices!? Here's what to do:
https://pnwcomputers.blogspot.com/2024/07/i-think-someone-is-accessing-my.html

Fake Tech Support Scam: What You Should Do:
https://pnwcomputers.blogspot.com/2024/07/fake-tech-support-scam-what-you-should.html

Fake Hard Drive Diagnostic Virus; Browser Pop-up/Redirection Fix

Pacific NorthWest Computers KNOWS rogue security and fake software applications very well. Fake software virus applications make up for 85% of the infections that we see on a day-to-day, week-to-week, month by month basis here in the shop. At first it was just fake security software programs. But the newest "trend" in the fake malicious software world is fake hard drive diagnostic software.

This fake diagnostic software virus pretends to have found issues with your hard drive, proceeds to hide your data (to seem more legitimate) and then tries to sell it self as a fix for all "problems" it has identified with your hard drive. When first released, it was not to difficult to remove. But the issue we are running into now however is that when a customer brings a system in that has this virus on it, we aren't just worrying about just getting the virus removed. But more importantly, reversing the changes the virus has made to an affected system. The big challenge has been with Browser hooks.

(Our Updated Browser Infection Blog Article Found Here)

Most of the time when we encounter this virus it will actually "hook" into (or simply put; infect) the executable "IExplorer.exe", which is Internet Explorer. Once "hooked" the virus can change, modify how Internet Explorer functions and can generate pop-ups and redirect searches and navigation in the browser. All after the virus cleaning is completed on the affected computer. Now, most of the time programs like Spybot Search & Destroy are very effective at reversing system modifications created by viruses. But so far, this browser hook issue is not "automatically" fixed by virus scanners and utilities and since hooks can sometimes be impossible to remove. This type of an issue can prevent us from declaring a system clean and can sometimes require us to reinstall the computer's operating system. Well, we think we figured out a fix!

After working on a computer from a local insurance agency, I did some extensive poking around an infected computer's file system and registry and was able to locate a registry location for something called “DOMStorage” under Internet Explorer’s HKEY_ CURRENT_USER registry key (HKCU\Software\Microsoft\Internet Explorer\DOMStorage). In this registry entry, I found folders matching the names for some of the websites that were being generated in the random IE pop-ups's. I knew I was onto something but did not know what "DOMStorage" even was nor did I know why or how Internet Explorer even used it.

After doing some research on DOMStorage (http://en.wikipedia.org/wiki/Web_storage) it looks like DOMStorage, or Document Object Model Storage, is a web application software method and protocol used for storing data in a web browser. So I thought to myself, “Well if they can store data there, they could very well plant a program in those locations to hide and allow themselves to generate those pop-ups!”. So I went ahead and deleted all of the folders in the DOMStorage registry location (and there were A LOT of sites listed in there) and it’s safe to now say after removing those folders there have not been ANY Internet Explorer pop-ups since! After pop-ups coming up several times a minute, the system is running great and is running flawlessly for several days; with web surfing and all! No browser re-directions or anything!

(Our Updated Browser Infection Blog Article Found Here)

So I would say this is another problem solved and another win against viruses for Pacific NorthWest Computers!

Jon Pienkowski
Owner/Operator
Pacific NorthWest Computers

Rogue Hard Drive Error Repair Software

A new fake HD repair/error finding virus software is going around, and it hides all of your personal data so it  looks like all of your data has been lost or deleted; RUN FULL, MANUAL, VIRUS SCANS ASAP IF IT HAS BEEN A WHILE and MORE OFTEN THAN USUAL!

Rogue Security Program Infections; At a Glance!

More and more everyday I am see and hear about people becoming infected with Rogue security Software virus. 

Rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing. – Wiki

Right now the most common form of infection they are using is web page hi-jacking and “trap” websites that are created to “host” the virus (why using Firefox is so important).

So what people end up encountering is a web page that has been hacked, hi-jacked, infected or exploited that is unknowingly “hosting” this virus and ends up spreading the infection to whom ever visits the website. In doing this, their trap has been set and the infections begin! This form of infection is commonly refered to as a “Drive-by Download“.

After the computer becomes infected, users start to see and encounter “security warning” icons in their task bar (lower right of the desktop), pop-ups warning of an infection and fake animated virus scans indicating your computer is infected as the virus itself tries to build its credibility. In  most cases the virus can even infect the Windows Security Center making it even harder for users to identify whether the software is real or not. However the goal being achieved out all of this is for the virus creators to make money. So they are hoping that the users of the computers that become infected, and fooled by the “song and dance” the virus puts on, and buy their infectious and fake security software.

So I wanted this to be a little heads up and explanation for everybody about this subject since it is the most common repair I encounter to date.

Be Aware, Stay Informed and Scan Often!
 
~Jon Pienkowski, Pacific NorthWest Computers

Recommended Browser Extensions & Add-On's

What we wanted to do is share our favorite, most recommended & most used Firefox & Google Chrome Extensions! So please, I hope you check them all out and maybe consider using them with your favorite browser! 

1. BetterPrivacy; Ever wondered why you are still tracked though you tried everything to prevent it? BetterPrivacy is a Super Cookie Safeguard which protects from usually not deletable LSO's. It blocks longterm tracking on Google, YouTube Ebay and many others...
   
2. Colorful Tabs (Firefox); The most beautiful yet the simplest add-on that makes a strong colorful appeal. Colors every tab in a different color and makes them easy to distinguish while beautifying the overall appearance of the interface.
   
3. Cooliris; Simply the fastest and most stunning way to browse photos and videos from the Web or your desktop. Effortlessly scroll an infinite "3D Wall" of your content from Facebook, Google Images, YouTube, Flickr...
   
4. Firebug  (Firefox); Firebug integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page...
   
5. FireFTP; A free, secure, cross-platform FTP client for Chrome and Firefox which provides easy and intuitive access to FTP servers.
   
6. Flagfox; Displays a country flag depicting the location of the current website's server and provides quick access to detailed location and webserver information.
7. Long URL Please; Replaces short urls with the originals so you can see where links actually link to.
   
8. NoScript; The best security you can get in a web browser! Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
   
9. Pocket; Pocket allows you to save web pages of interest to read later. It eliminates cluttering of bookmarks with sites that are merely of a one-time interest.
   
10. WOT; Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory.
11. Google Cast; Send content to your Chromecast and other devices that support Google Cast.
12. LastPass; LastPass is a free password manager and form filler. LastPass is also available for Firefox, Internet Explorer, Opera and Safari.
13. AdBlock; One of the most popular extensions, with over 15 million users! Blocks ads all over the web.
14. Chrome to Mobile; Send web pages from Chrome on your computer to Chrome on your phone or tablet.
15. After the Deadline; Check spelling, style, and grammar in your browser.
16. HTTPS Everywhere; Encrypt the Web! Automatically use HTTPS security on many sites.
17. Keep My Opt-Outs; Permanently opts your browser out of online ad personalization via cookies.
18. Lazarus: Form Recovery; Autosaves everything you type so you can easily recover from form-killing timeouts, crashes and network errors.
19. MightyText; Text from Chrome! Sync'd with Android ~ SMS & Texting like Google Voice in Google Chrome! 

Let us know of any issues with links!

Updated 10/9/2017
pnwcomputers@gmail.com