.ANN Files Virus – How to Remove It + Restore Encrypted Data

.ANN Files Virus – How to Remove It + Restore Encrypted Data


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by .ANN Files Virus and other threats.
Threats such as .ANN Files Virus may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

This article has been created in order to explain what is Ann Ransomware and how to remove it from your computer plus how you can try and get back .ANN encrypted files.

The .ANN files virus is the type of malware which aims to encrypt the files on your computer, preventing you from accessing them. The Ann Ransomware virus, which uses this file extension aims to get victims to write to the e-mails of the cyber-criminals with the idea that they are paid to restore the files in some form. And to further stress the victim, the crooks give a deadline of 7 days to make a payment in their ransom note file, called #README_ANN#.rtf. If you are one of the victims of Ann Ransomware, we recommend that you read this article completely and learn how you can remove this ransomware infection from your computer and how you can try and restore files, encrypted by it.

Threat Summary

Name.ANN Files Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the computers, compromised by it and then make sure to download.
SymptomsThe files have the .ANN file extension added to them. The ransomware virus also drops a ransom note type of file, called #README_ANN#.rtf.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .ANN Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .ANN Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.ANN Files Virus – Spread

In order to infect the computers of users, the .ANN files virus may trick victims into downloading and installing a malicious e-mail attachment on the computers of victims. This attachment’s primary goal is to get users to download and run it. Such e-mail attachments often pretend to be various different documents of importance, like:

  • Invoices.
  • Receipts.
  • Banking statements.
  • Letters of confirmation.

The e-mail senders are also usually well faked, and in most cases they tend to imitate big companies, like eBay, PayPal, DHL and others.

Furthermore, what also seems to be a possible method of replication is that the malware infection file may be uploaded on suspicious software-providing sites or torrent sites as a fake program of some sort. The most often imitated programs of this type usually tend to be:

  • Game patches or game cracks.
  • Software activators.
  • Key generators.
  • Online license activators.
  • Other forms of hacktools.
  • Portable programs.

.ANN Files Virus – More Information

Once an infection with the .ANN files virus has been conducted, the ransomware virus aims to drop it’s payload files on the victim’s computer. The payload files of this virus may be dropped in the following Windows folders:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

The .ANN files virus is the type of malware, that may first check if it’s running on a virtual drive or if it has previously infected the victim machine. If not, then the ransomware may proceed to encryption and may display it’s ransom note file. The ransom note file of the .ANN ransomware may contain the following ransom message:



We are realy sorry to inform you that ALL YOUR FILES WERE ENCRYPTED

by our automatic software. It became possible because of bad server security.


Please don’t worry, we can help you to RESTORE your server to original

state and decrypt all your files quickly and safely!


Files are not broken!!!

Files were encrypted with ABS-128+RSA-2048 crypto algorithms.

There is no way to decrypt your files without unique decryption key and special software.

Your unique decryption key is securely stored on our server. For our safety, all

information about your server and your decryption key will be automaticaly DELETED

AFTER 7 DAYS! You will irrevocably lose all your data!

Please note that all the attempts to recover your files by yourself or using third party

tools will result only in irrevocable loss of your data!

Please note that you can recover files only with your unique decryption key, which

stored on our side. If you will use the help of third parties, you will only add a middleman.


Please write us to the e-mail (write on English or use professional translator):

[email protected]
[email protected]
[email protected]

You have to send your message on each of our 3 emails due to the fact that the message may not reach their intended recipient for a variety of reasons!

In subject line write your personal ID:

We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files.

Please note that files must not contain any valuable information and their total size must be less than 5Mb.


Please be sure that we will find common languge. We will restore all the data and give

you recommedations how to configure the protection of your server.

We will definitely reach an agreement ;I


If you did not receive the answer from the aforecited emails for more then 24 hours please send us

Bitmessages from a web browser through the webpage {URL}. Below is a tutorial on how to send bitmessage via web browser:

1. Open in your browser the link {url} up and make the registration by entering name email and password.

2. You must confirm the registration, return to your email and follow the instructions that were sent to you.

3. Return to site and click “Login” label or use link httpszfibitmsgmefusersfsign in, enter your email and

password and click the “Sign in” button.

4. Click the “Create Random address” button.

5. Click the “New massage” button.

6. Sending message:

To: Enter address: BM-ZcUPmiEDstzWCSZmbtbeJeUNHquERLl

Subject: Enter your ID: I l

Message: Describe what you think necessary.

Click the “Send message” button.

In addition to this, the .ANN files virus may also modify the following registry entries to automatically run the ransom note and the malicious files of this virus. The registry sub-keys in which entries may be created could be the following:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Furthermore, the .ANN ransomware virus may also delete the backed up files by Windows by running a malicious script which directly deletes the shadow volume copies of your PC by entering commands as an administrator in the Windows Command Prompt. The commands may be the following:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

.ANN Files Virus – Encryption Process

In order to encrypt the files on your computer, the .ANN files virus is the type of malware which will first scan for the files it want to encrypt, while excluding important Windows directories, like %System% or %System32%. The files that Ann ransomware may detect based on their file extensions likely are the following:

  • Documents.
  • Videos.
  • Pictures and any form of image files.
  • Backup file format.
  • Online signatures.
  • Databases.
  • Archives.
  • Audio files.
  • Virtual operating systems.

The ransomware supposedly encrypts the files by using the combination of the following two algorithms:

  • AES-128
  • RSA-2048

After the encryption, unique decryption key that is also encrypted itself is generated and the only ones with access seem to be the cyber-criminals. The files have the .ANN file extension and they appear like the following:

Remove .ANN Files Virus and Restore .ANN Encrypted Files

If you want to make sure that this virus Is eliminated from your computer, you can go ahead and follow the removal instructions underneath this article. These instructions are divided in manual and automatic removal methods. Be advised, that for maximum effectiveness and a safe removal, security experts strongly recommend that users download and run a scan, using an advanced anti-malware program. Such software is created to fully remove all traces of Ann Ransomware and other malware that may currently reside on your PC and then make sure that it stays protected against future infections as well.

If you want to recover files, that are encrypted with the .ANN file extension added to them, we do advise that you follow the instructions underneath this article in step “2. Restore files, encrypted by Ann Ransomware”. The methods there may not be fully effective against this ransomware virus, but they may help you recover as many files as possible via these alternative approaches.

Note! Your computer system may be affected by .ANN Files Virus and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as .ANN Files Virus.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove .ANN Files Virus follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove .ANN Files Virus files and objects
2. Find files created by .ANN Files Virus on your PC

Before starting the Automatic Removal below, please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by .ANN Files Virus

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share