How to remove RegretLocker ransomware on Windows 10

2 min. read

Published onNovember 4, 2020

published onNovember 4, 2020

Share this article

Improve this guide

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Key notes

RegretLocker is a recently identified malicious software and classified asransomware. Recently, it started to targetWindows 10.

All systems infected with thisransomwarehave their data encrypted and all of the affected files are appended with the .mouse extension.

For example, a regular 1.jpg file would appear as 1.jpg.mouse. After the encryption process is complete, ransom notes titledHow to restore files.txtare dropped into compromised folders.

Moreover, users receive ransom demands for the decryption. The issue is now affecting Windows Hyper-V virtual machine as well.

In this case, a virtual hard disk is created and stored in a VHD or VHDX file, containing a raw disk image, including a drive’s partition table and partitions.

How can I remove RegretLocker ransomware on Windows 10?

In order to remove RegretLocker ransomware on Windows 10, you simply need to apply the above steps. The code used by RegretLocker may have its source from arecently published security research.

When it comes to the affected Windows Hyper-Vvirtual machines, RegretLocker uses the Windows Virtual Storage API OpenVirtualDisk, AttachVirtualDisk, as well as GetVirtualDiskPhysicalPath functions to easily mount and compromise virtual disks.

Also, the Windows Restart Manager API is involved in the process, to terminate Windows services that keep a file open during encryption.

Have you been affected by the RegretLocker ransomware? Let us know if the above procedure proved to be useful in your case too.

[wl_navigator]

How to remove RegretLocker ransomware on Windows 10#

How can I remove RegretLocker ransomware on Windows 10?#

How to remove RegretLocker ransomware on Windows 10

How can I remove RegretLocker ransomware on Windows 10?