Share this article
Improve this guide
Secure Volume Shadow Copy in Windows 10/11 now [Ransomware]
3 min. read
Published onOctober 5, 2020
published onOctober 5, 2020
Share this article
Improve this guide
Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more
Key notes
Isn’t at all uncommon to seeransomwaredeleting all Windows shadow copies using vssadmin. However, things are about to change thanks to Raccine.
Users worldwide are aware of the issue and look for reliable solutions. Here’s what one of themsays:
Most modern ransomware removes shadow copies though.
You can now use Raccine to terminate all processes that try to delete Shadow volumes using exactly Microsoft’s vssadmin.exe program.
The good news is that it always acts before ransomware stands a chance to startencryptingdata on your PC.
What is Volume Shadow Copy Windows 10?
Volume Shadow Copy Service or VSS is a special Microsoft Windows technology used to create backup copies or snapshots of volumes or computer files.
This can happen even when they are in use. Just remember that for volumes under 500 megabytes, the free space required if of minimum 50 megabytes.
For volumes over 500 megabytes, the number changes to a minimum of 320 megabytes this time.
How can I install and use Raccine?
Raccine basically works by registering the raccine.exe executable as a debugger for vssadmin.exe. It does so by using the Image File Execution Options Windows registry key.
Once you register raccine.exe as a debugger, every time vssadmin.exe is executed, it will also launch Raccine, which will check to see if vssadmin is trying to delete shadow copies.
If it happens to discover that a process is indeed using vssadmin delete, it will automatically terminate the process.
How to delete Shadow copies Windows 10?
If your wish is to delete Shadow copies in Windows 10, then click theWin + Rkeyboard shortcutto open the Run dialog, inputSystemPropertiesProtection, and pressEnter.
Up next, you just need to select a partition to delete all these shadow copies from, and chooseConfigure.
Finally, make sure to pressDeletein order to remove all restore points from this drive or partition, and clickApply.
You can delete shadow copies to free up space in yourcomputerbut never think of that any longer due to ransomware threats.
Raccine can easily solve this particular issue. Let us know in the comments area below if you tried it already.
[wl_navigator]
More about the topics:Ransomware
Loredana Harsana
Windows Software Expert
Loredana is a passionate writer with a keen interest in PC software and technology. She started off writing about mobile phones back when Samsung Galaxy S II was on top of the world and she fell in love with tech of all sorts.
Whenever she’s not at her work desk, you’ll find her enjoying refreshing tea flavors, spilling stories on paper, and listening to the radio.
User forum
0 messages
Sort by:LatestOldestMost Votes
Comment*
Name*
Email*
Commenting as.Not you?
Save information for future comments
Comment
Δ
Loredana Harsana
Windows Software Expert
Loredana is a tech enthusiast who tackles mobility, privacy, and networking in easy-to follow guides for everyone.
