How to remove AnimusLocker ransomware

Animus ransomware – a file encrypting virus that started using the patterns of Scarab ransomware

Animus ransomware (also dubbed AnimusLocker) is a dangerous file-encrypting virus which belongs to cryptovirus category.^[1] The first version of ransomware is using AES encryption algorithm to encrypt files and then appends .animus extension to each of the files. However, recently security experts noticed yet another version of Animus ransomware that is using Scarab ransomware code and is appending .anonimus.mr@yahoo.com file extension to victim's files. Soon after that, the encrypted data becomes unreadable and none of the files can be accessed anymore. To regain files held hostage, victims need to obtain a key which only hackers possess. They ask for $100 in Bitcoin cryptocurrency inside the ransom note ANIMUS_RESTORE.txt, ANIMUS_RESTORE2.txt or ANIMUS_RESTORE3.txt which is dropped into each of the affected folders.

Animus Locker virus typically spreads using malicious spam emails. This method is relatively old, as hackers were employing bots to send out malware attached to it for a long time. However, because this distribution method is very effective, it is still the most prevalent. As soon as victims execute the malicious payload on their devices, a picture file prettycat.jpg is turned into prettycat.jpg.animus and becomes unusable.

Next, Animus ransomware distributes a message from cybercrooks so that users would be aware of what happened, and that the only way to recover files is by contacting them via using j0ra@protonmail.com and eventually paying the demanded sum of $100. Ransom note displays the following message:

<><><><><><><><><><><><><># animus locker #<><><><><><><><><><><><><>
SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit),
We strongly RECOMMEND you not to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price,
If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here:
j0ra@protonmail.com
########
!ATTENTION!
Attach file is 000000000.key from %appdata% to email message,
Without it we will not be able to decrypt your files
########
And pay 100$ on 1G5TThb5tcJ3LQbF4C4Tibgd9y7m3iYPFH wallet
If someone else offers you files restoring, ask him for test decryption,
Only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.
<><><><><><><><><><><><><># animus locker #<><><><><><><><><><><><><>

The list of encrypted files ranges from personal photos to databases used for important tasks. Therefore, it is not surprising that many users rush to pay cybercriminals, as they think that it is the only way to get data back. However, be careful and DO NOT pay the demanded ransom^[2]. Users often get scammed and end up with nothing, as hackers simply ignore victims. Due to that, security experts^[3] strongly advise users to perform Animus removal by installing professional anti-malware software.

All decryption tools are stored on a remote server and are within reach only for the cybercriminals. There is no way to find out the decryption code and recover files after encryption unless you have them backed up on a cloud service or an external device. Unfortunately, the same key can not be used twice either.

To conclude, you should not contact cybercriminals and remove Animus ransomware from your device. Do not attempt manual elimination as it will only result in a failure and may even damage your system even further. Instead, download FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and perform full system scan.

Ransomware-type viruses are distributed using various techniques

The most common ransomware distribution method is via the spam emails. The virus activates as soon as the malicious attachment is opened (beware: these type of files typically ask for a macro function to be enabled) or the suspicious hyperlink is clicked. To avoid dangerous infections, make sure you open only legitimate emails and learn to recognize phishing ones.

Also, if you like visiting online game sites, using P2P networks, watching videos or listening to songs on various questionable websites, the risk of infection also increases. Additionally, websites that are rarely moderated can be hacked and malicious code injected without the authors' knowledge. 

To avoid such harmful activity and keep your PC safe, follow these steps:

• If you get a spam email – do not risk opening it. Better send it to the trash section.
• Avoid using third-party sites and installers. Download software only from trusted sites and their original downloading links in order to secure yourself from ransomware.
• If you like playing online games or watching videos online, be sure you do that only on trustworthy websites. Avoid visiting suspicious-looking ones.
• Backup your files – it is the only trusted way to recover your data.
• Install an anti-virus program. It will increase your safety level and help you deal with various infections that can be encountered on the internet (note, real-time protection function is a must).
• Most importantly – always be cautious about everything you do while browsing the Internet. You can avoid a lot of infections this way and keep your computer and important files safe.

Eliminate Animus ransomware with professional tools

To remove Animus Locker virus, you need to download and install a reliable anti-malware program. We recommend downloading one of these: FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes. Only professional tools can help you with complete virus elimination.

After Animus removal is complete, you can proceed with the file recovery. If you had a backup on the cloud server or remote device, you could restore data from there (note: DO NOT attempt to recover files before you are sure that the virus is completely gone). In case you do not have a backup, check out few alternative methods that could help you. Nevertheless, the recovery chance is relatively small, although not impossible.