Removal Guide: Uninstall Xampp Locker Ransomware and Recover Files Having ‘.locked’ Extension

Xampp Locker Ransomware – All You Need to Know

 

Xampp Locker Ransomware is a data encrypting virus that was first spotted on February 13, 2017 on several computers. After basic analysis, security analysts reported that Xampp Locker is purely coded into .NET programming languages and it’s based on Utku Sen’s HiddenTear project. You may have remembered that HiddenTear was a ransomware education project that was first uploaded on GitHub – a forum of developers and programmers. But, unfortunately, nowadays project is being used for releasing deadly encryption-trojans in order to boost up Bitcoin Wallet balance illegally. Let us remind you that ‘Xampp’ is a very famous software that provides users with a quick way to create a fully functional Web server with PHP, MySQL, FTP and a Mail server. Ransomware developers are using the same name to dodge uses into installing Xampp Locker Ransomware unknowingly.

Xampp Locker Ransomware is powered by a custom cipher that is made of combination of AES-256 and RSA-2048 encryption algorithms. Primarily, it targets the most commonly used data containers like Videos, Photos, Music, Compressed Files, Office Documents, Spreadsheets, Presentations and so on. Once your files are indexed, Xampp Locker Ransomware deploys a custom cipher to encode your files and appends ‘.Locked’ suffix into their names. For instance, your ‘FAMILY_REUNION.mp4’ will be altered as ‘FAMILY_REUNION.mp4.locked’. The same suffix is used by Hackerman Ransomware, Locky Ransomware and more. Concept behind using the same suffix, may be to scare victims and make them believe that there is other option rather than paying ransom for decoding encoded files on the compromised computer.

Xampp Locker Ransomware – Ways of Distribution

Xampp Locker Ransomware may arrive on your computer via spam campaigns organized by cyber extortionists. During the campaigns, they send spam emails containing exploit kit, share embedded links on social media networks, distributes infected files though Torrents sites etc. They could also mislead inexperience computer users into installing trojanized Windows Critical Updates or Existing Software Updates from malicious sources. Furthermore, you you should know that Xampp Locker Ransomware can take over on your computer just right after your one wrong click. Since, exploit kit, Scripts or Payloads are highly responsible for delivering the ransomware infection on the targeted computer via various sources.

Therefore, we advise you to secure your computer by installing highly active Antimalware software on your PC and home computers. If you have already an Antimalware, then you should not forget to keep it up-to-date and activated. While installing pirated software or games, you should never disable your Antimalware shield, if it detects any infected file, allow it to remove the file immediately. Finally, you can proceed Xampp Locker Ransomware removal process now:

Free Scan your Windows PC to detect Xampp Locker Ransomware

 

Remove Xampp Locker Ransomware From Your PC

Step 1: Remove Xampp Locker Ransomware in Safe Mode with Command Prompt

• First of all disconnect your PC with network connection.
• Click restart button and keep pressing F8 key regularly while system restart.

• You will see “Windows Advanced Options Menu” on your computer screen.

• Select “Safe Mode with Command Prompt” and press Enter key.

• You must login your computer with Administrator account for full privilege.

• Once the Command Prompt appears then type rstrui.exe and press Enter

• Now follow the prompts on your screen to complete system restore.

Step 2: Remove Xampp Locker Ransomware using MSConfig in Safe Mode:

• Power off your computer and restart again.
• While booting press the “F8 key” continuously to open “Windows Advanced Options Menu”.

• Use the arrow keys to select “Safe Mode” option and press Enter key.

• Once system get started go to Start menu. Type “msconfig” in the search box and launch the application.

• Go to the Startup tab and look for files from %AppData% or %Temp% folders using rundll32.exe. See an example below:

C:\Windows\System32\rundll32.exe C:\Users\username\appdata\local\temp\regepqzf.dll,H1N1

• Disable all the malicious entries and save the changes.
• Now restart your computer normally.

Step 3 : Kill Malicious Process Related To Xampp Locker Ransomware

• Press Alt+Ctrl+Del buttons together.

• It will open the Task manager on your screen.
• Go to Process Tab and find Xampp Locker Ransomware related process.
• Click the End Process Now button to stop the running process.

Step 4 : Remove Xampp Locker Ransomware Virus From Registry Entry

• Press “Windows + R” key together to open Run Box.

• Type “regedit” and click OK button.

• Find and remove Xampp Locker Ransomware related entries.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Now hopefully you have completely removed the Xampp Locker Ransomware virus from your computer. If you are still get ransom message from the threat or unable to access your files, then it means that virus still remain into your computer. In such situation you don’t have any other option except removing this virus using any powerful malware removal tool.

Whereas if you have any backup of your infected or encrypted files, then you can also reinstall your Windows OS. This will erase all your files and data as along with the Xampp Locker Ransomware infection. You will get a completely empty computer system with no files. Now you can use your backup to get your files. If you don’t have any backup then using malware removal tool is a better option for you.

If you have any query or question regarding your computer, then you can easily ask your problem to our experts. Go to the Ask Any Question page and get the answer for your query directly from out experts.