Acuff ransomware (Virus Removal Guide) - Recovery Instructions Included

Acuff virus Removal Guide

What is Acuff ransomware?

Acuff ransomware – new file-locking cyber infection from the Phobos family

Acuff ransomwareAcuff ransomware - the threat that demands big money for alleged decryption.

Acuff ransomware is a cryptovirus that locks all non-system files and requests a ransom for the decryption technique. It derives from the infamous Phobos ransomware family. As soon as viruses from this lineage gain access to a targeted computer system, they start their bidding immediately. The first phase is the encryption. The virus locks all files with an army based algorithm so that only the developers will be able to unlock it, and furthermore, it appends all non-system files with a three-part extension, consisting of victims' prescribed IDs', criminal email address, and .Acuff. That same appendage technique is used by Dharma family members like RXD ransomware.

Phase two is money extortion – the main goal of such malicious actors like the ones who released Acuff file virus. Right after the encryption process completion, two different ransom notes are created: one as an info.txt file, the other one as an irritating pop-up window (info.hta). The first one is very short and consists only of a concise explanation that the victim files were encrypted, and two emails (, are provided to establish contact.

The latter one is much more explanatory, full of instructions on what to do and warnings of what shouldn't be attempted, guidelines on how to buy cryptocurrency Bitcoin (cybercriminals in most cases ask for Bitcoins as ransoms), and a free 5 file decryption guarantee. With it, developers of the Acuff ransomware virus want to prove to the victims that they really possess the decryption software required to unlock their files. You can find both ransom notes disclosed at the bottom of this paragraph.

name Acuff ransomware
type Ransomware, Cryptovirus
ransomware family Phobos ransomware
ransom note A pop-up window (info.hta) and a text file (info.txt) are created and opened after successful encryption of victims data
appended file extension Like all its dirty ransomware family, the Acuff virus appends all non-system files with a three-part extension – victims ID, criminal contact email (, and .Acuff
criminal contact details,
issues All personal files (photos, video/audio files, documents, archives, etc.) are renamed and inaccessible
malware removal Trusty anti-virus software should be used to automatically remove Acuff ransomware
system restore To undo whatever the virus has done to the system, its files, and setting, we strongly advise using the FortectIntego tool to tune-up your device

Although, at times that paying the requested ransom is the only possible way to get your files back – we strongly advise against that. There are numerous documented cases that victims of cyberattacks who agreed with the demands were either scammed for more money or never heard back from the cybercriminals. That wouldn't necessarily happen with Acuff ransomware developers, but we advise focusing on your systems being virus-free instead.

Using robust anti-malware software is a must in this day and age. Anti-virus applications should be able to detect incoming threats, isolate, and delete them instantly. To safely remove Acuff ransomware, we advise using Malwarebytes or SpyHunter 5Combo Cleaner apps.

Unfortunately, anti-virus software can't fix your computers' registry and other settings that the virus changed to thrive. Experts[1] advise using the FortectIntego tool, after Acuff ransomware removal, to automatically scan and fix whatever the crypto infection got its dirty hands on.

These security programs also cannot fix files that get encoded after Acuff ransomware virus attack. You need to properly clear the infection and eliminate any related files, programs, so you can recover files by using data backups stored on an external drive or the cloud database.

Acuff virusAcuff file virus is a ransomware-type infection that has no particular symptoms besides file-locking.

Ransom note from Acuff ransomware developers delivered via in info.hta reads:

All your files have been encrypted!
Your PC has been infected by a ransomware. If you want to restore them, contact the following address below.
E – Mail contact – /
Write this ID in the title of your message –
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
Where to buy bitcoins?
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
Also you can find other places to buy Bitcoins and beginners guide here:
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Ransom note in info.txt contains this message:

Your PC has been infected by a ransomware. If you want to restore them, contact the following address below.

E – Mail contact – /


Avoid becoming a cybercriminals victim

Cybercriminals are looking to unleash their creations not only on big corporations but on everyday people too. They are indifferent about where their income comes from. There's malware hidden everywhere on the internet, and so computer users should be aware of these most common methods of its spread:

  • File-sharing platforms
  • Mischievous email hyperlinks
  • Malicious email attachments

Acuff ransomware virusAcuff ransomware is a virus that belongs to the Phobos family.

These three ways to infect your computer seem so obvious but yet again, people ten to forget them and become victims of cybercrimes. The best precaution is to have backups and powerful anti-malware software protecting your devices. By all means, not visiting torrent or any other fishy sites, not opening any emails that your sure the sender is who he says he is, and not downloading any email attachments without scanning them first, would do wonders for the security of your devices.

Removal guidelines for the Acuff ransomware virus

There are various kinds of malware[2], but believe us, there's no malware you'd like to keep. It should be deleted from all infected devices immediately after detection.[3] It is our recommendation to remove Acuff ransomware with SpyHunter 5Combo Cleaner and Malwarebytes anti-virus programs. Keeping those apps update could save you from cyber headaches in the future.

Although, Acuff ransomware removal with anti-malware software is just the first step to getting your device into a pre-contaminated state. To fully restore your computer to a normal state, you should use the FortectIntego. It will automatically locate any changes done to the system by the virus and reverse them. Only then you can move on to data backup options.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of Acuff virus. Follow these steps

Manual removal using Safe Mode

Reboot the machine in Safe Mode with Networking and remove Acuff ransomware properly

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove Acuff using System Restore

Use System Restore and recover computer in a previous state when the virus was not active

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Acuff. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that Acuff removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Acuff from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

If your files are encrypted by Acuff, you can use several methods to restore them:

Data Recovery Pro option for encrypted files

You can restore data after accidental deletion or Acuff ransomware attack with a program like Data Recovery Pro

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Acuff ransomware;
  • Restore them.

Windows Previous Versions feature for data recovery

If System Restore gets enabled beforehand, you can rely on this feature and restore individual files

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer helps after Acuff ransomware encryption

Shadow Volume Copies can be used to recover encrypted data

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Decryption tool for Acuff ransomware is not revealed yet

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Acuff and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.


Lost your files? Use data recovery software

While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.

To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.

About the author
Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions