How to remove AnimusLocker ransomware and decrypt .animus files

What is AnimusLocker ransomware

AnimusLocker – is a virus of a ransomware type. This kind of viruses are doing pretty much same thing: first they sneak into a user’s system, then they start encryption process; Once the encryption procedure is done, ransomware demand for money for decryption. Encrypted files can’t be used until they are decrypted. The thing is – all the sensitive data is being hit by ransomware, that’s why it is critical to know what to do in such unpleasant situation. First of all, let’s make it clear – there is no guarantee you will get your files back after the payment, a lot of cyber criminals have no idea how to decrypt encrypted data. We recommend you not to pay anything to these people. In this guide you may learn how to remove AnimusLocker ransomware and decrypt .animus files without paying anything.

The way this ransomware works is quite simple – first of all, AnimusLocker breaks through your system, then starts encrypting procedure with AES encryption algorithm. AnimusLocker ransomware adds .animus extension to the name of all the encrypted files. For example, sample.txt file turns into sample.txt.animus file. Once all the data is encrypted, the ransomware will drop 3 files: ANIMUS_RESTORE.txt, ANIMUS_RESTORE2.txt and ANIMUS_RESTORE3.txt. You may find demands of cyber criminals in it, here is AnimusLocker ransom note:

<><><><><><><><><><><><><># animus locker #<><><><><><><><><><><><><>
SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit),
We strongly RECOMMEND you not to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price,
If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here:
j0ra@protonmail.com
########
!ATTENTION!
Attach file is 000000000.key from %appdata% to email message,
Without it we will not be able to decrypt your files
########
And pay 100$ on 1G5TThb5tcJ3LQbF4C4Tibgd9y7m3iYPFH wallet
If someone else offers you files restoring, ask him for test decryption,
Only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.
<><><><><><><><><><><><><># animus locker #<><><><><><><><><><><><><>

Here’s the list of extensions that AnimusLocker ransomware will encrypt:

.cat, .csv, .db, .doc, .gif, .htm, .ico, .inf, .ini, .jpg, .png, .ppt, .sam, .shw, .txt, .url, .xls, .xml, .wav, .wb2, .wk4, .wpd, .wpg
These are MS Office documents, OpenOffice, PDF, text files, databases, photos, music, video, image files, archives and so on.

There are two solutions of this problem. First is to use special Removal Tool. Removal Tools delete all instances of malware by few clicks and help user to save time. Or you can use Manual Removal Guide, but you should know that it might be very difficult to remove AnimusLocker ransomware manually without specialist’s help.

AnimusLocker Removal Guide

1. Download AnimusLocker Removal Tool.
2. Remove AnimusLocker from Windows (7, 8, 8.1, Vista, XP, 10) or Mac OS (Run system in Safe Mode).
3. How to restore files
4. How to protect PC from future infections.

How to remove AnimusLocker ransomware automatically:

Download Norton Security This removal tool can help you to get rid of this nasty virus and clean up your system. In case you need a proper and reliable solution, we recommend you to download and try it. This anti-ransomware removal tool is able to detect and remove AnimusLocker ransomware from your system.

Manual AnimusLocker Removal Guide

Below is step-by-step instructions to remove AnimusLocker from Windows and Mac computers. Follow this steps carefully and remove files and folders belonging to AnimusLocker. First of all, you will need to run system in a Safe Mode. Then find and remove needed files and folders.

Uninstall AnimusLocker from Windows or Mac

Here you may find the list of confirmed related to the ransomware files. You should delete them in order to remove virus, however it would be easier to do it with our automatic removal tool. The list:

ANIMUS_RESTORE.txt
ANIMUS_RESTORE2.txt
ANIMUS_RESTORE3.txt
Ransom.exe
996E.exe
000000000.key
AnimusLocker.exe
HKEY_USERS\\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe

Windows 7/Vista:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to AnimusLocker by using Removal Tool;
5. Delete found files;

Windows 8/8.1:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to AnimusLocker by using Removal Tool;
5. Delete found files;

Windows 10:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to AnimusLocker by using Removal Tool;
5. Delete found files;

Windows XP:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to AnimusLocker by using Removal Tool;
5. Delete found files;

Mac OS:

1. Restart the computer;
2. Press and Hold Shift button, before system will be loaded;
3. Release Shift button, when Apple logo appears;
4. Find programs or files potentially related to AnimusLocker by using Removal Tool;
5. Delete found files;

How to restore encrypted files

If you can’t decrypt your files or just don’t want to use those instructions, you can try to restore your files with special tools. You may find these tools below in this section.

Restore data with Stellar Data Recovery

This program can restore the encrypted files, it is easy to use and very helpful.

1. Download and install Stellar Data Recovery
2. Choose drives and folders with your data, then press Scan.
3. Select all the files in a folder, then click on Restore button.
4. Manage export location. That’s it!

Restore encrypted files using Recuva

There is an alternative program, that may help you to recover files – Recuva.

1. Run the Recuva;
2. Follow instructions and wait until scan process ends;
3. Find needed files, mark them and Press Recover button;

How to prevent ransomware infection?

It is always rewarding to prevent ransomware infection because of the consequences it may bring. There are a lot of difficulties in resolving issues with encoders viruses, that’s why it is very vital to keep a proper and reliable anti-ransomware software on your computer. In case you don’t have any, here you may find some of the best offers in order to protect your PC from disastrous viruses.

Malwarebytes

Download Norton Security

SpyHunter is a reliable antimalware removal tool application, that is able to protect your PC and prevent the infection from the start. The program is designed to be user-friendly and multi-functional.